joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4477f4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x46f32c]
cmp byte [eax + 0xc], 0
je 0x447961
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44795a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x470b98], 0
jne 0x447848
push 0x447968
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x447970
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470b98], eax
cmp dword [0x46ec98], 0
jne 0x447943
push 0x447980
call sub.kernel32.dll_LoadLibraryA
mov dword [0x46ec98], eax
cmp dword [0x46ec98], 0
je 0x447943
push 0x44798c
mov eax, dword [0x46ec98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470b9c], eax
push 0x44799c
mov eax, dword [0x46ec98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470ba0], eax
push 0x4479b0
mov eax, dword [0x46ec98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470ba4], eax
push 0x4479c8
mov eax, dword [0x46ec98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470ba8], eax
push 0x4479e0
mov eax, dword [0x46ec98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470bac], eax
push 0x4479f4
mov eax, dword [0x46ec98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470bb0], eax
push 0x447a0c
mov eax, dword [0x46ec98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470bb4], eax
push 0x447a24
mov eax, dword [0x46ec98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470bb8], eax
push 0x447a40
mov eax, dword [0x46ec98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470bbc], eax
push 0x447a4c
mov eax, dword [0x46ec98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470bc0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447961
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x44bca4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404a68
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x44bcf3
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404cd8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4534c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x453514]
test si, 4
je 0x4534d8
or bl, 1
test si, 8
je 0x4534e2
or bl, 4
test si, 1
je 0x4534ec
or bl, 8
test si, 2
je 0x4534f6
or bl, 0x10
test si, 0x10
je 0x453500
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45350f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x453518
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x453550]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x453531
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x453540
or bl, 4
test esi, 0x20000000
je 0x45354b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x459c14
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x459c26
add esp, 0xfffffff0
call fcn.00404014
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041afb0
mov eax, dword [0x46efd0]
mov dword [eax + 4], ebx
mov dword [eax], 0x459fb8
mov eax, dword [0x46efdc]
mov dword [eax + 4], ebx
mov dword [eax], 0x459fc4
mov eax, ebx
call fcn.00459fd0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41295c]
call fcn.00403cac
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41295c]
call fcn.00403cac
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41295c]
call fcn.00403cac
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41295c]
call fcn.00403cac
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41295c]
call fcn.00403cac
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x4563e8
push eax
push 0
push 0
mov eax, dword [0x46f128]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41ca34]
call fcn.0041e1cc
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41ca34]
call fcn.0041e1cc
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41ca34]
call fcn.0041e1cc
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045a420
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45a2e8
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45a2e8
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45a2e8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x459d63
call fcn.0040406c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45a0cc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45a277
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45a258
mov dl, 1
mov eax, dword [0x412f04]
call fcn.00403cac
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404a68
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45a247
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00447b54
test al, al
je 0x45a23a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45a288
lea eax, [ebp - 0x254]
call fcn.00409aac
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45a23a
xor eax, eax
push ebp
push 0x45a233
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45a2c0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45a21c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404cd8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45a21c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404cd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a23a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45a13d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004171a0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a27e
lea eax, [ebp - 0x260]
call fcn.00404a68
ret

Function at 0x45abc0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x470be4]
cmp byte [eax + 0xa5], 0
jne 0x45ac31
cmp dword [0x470bfc], 0
jne 0x45abf2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45ab7c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x470bfc], eax
cmp dword [0x470bf8], 0
jne 0x45ac0d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x470bf8], eax
cmp dword [0x470c00], 0
jne 0x45ac31
push esp
push 0
push 0
push 0x45ab20
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x470c00], eax
pop edx
ret
Function at 0x45b2c4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x470be4]
cmp dword [eax + 0x30], 0
je 0x45b36e
cmp dword [ebx + 0x94], 0
jne 0x45b368
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45b254
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45b368
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45b32e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45b368
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414e50
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45b33d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45becc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45bf01
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404b58
jmp 0x45bf0e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404abc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45d020
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45d061
mov eax, esi
call fcn.004430f8
test al, al
je 0x45d061
mov eax, dword [ebx + 0x84]
call fcn.00442df4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45d061
push 0
mov eax, dword [ebx + 0x84]
call fcn.00442df4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45ed50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45efb0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x45edb3
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0045e818
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040cdd8
cmp al, 1
jne 0x45edb3
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0045eb30
test al, al
je 0x45ef3f
cmp dword [ebp - 8], 0
jge 0x45edd1
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0045e818
mov eax, dword [ebp - 0x210]
call fcn.00404d28
cmp ebx, eax
jge 0x45ee1b
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0045e818
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x46f314]
and eax, 0xff
bt dword [edx], eax
jae 0x45ee1b
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x45ee2f
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0045ed2c
cmp ebx, dword [ebp - 8]
je 0x45ef31
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x45ee5b
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403ee4
and eax, 0x7f
movzx eax, word [eax*2 + 0x46eed8]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x45ef1e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403ee4
and eax, 0x7f
movzx eax, word [eax*2 + 0x46eed8]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00442df4
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403ee4
and eax, 0x7f
movzx eax, word [eax*2 + 0x46eed8]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00442df4
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ef25
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x45ef92
cmp dword [ebp - 8], 0
jge 0x45ef4a
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0045e818
mov eax, dword [ebp - 0x218]
call fcn.00404d28
cmp eax, dword [ebp - 8]
jg 0x45ef84
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0045e818
mov eax, dword [ebp - 0x21c]
call fcn.00404d28
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0045ed2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45efb7
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404a8c
ret
Function at 0x402ed0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x402f34
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x402f1d
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x402f0c
xor ecx, eax
xor edx, ebx
dec edi
jne 0x402efd
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x40affb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x40b00b
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 0
jle 0x40b060
push dword [ebp + 8]
call fcn.0040b20c
mov dword [ebp - 0x24], eax
cmp word [ebp - 0x24], 0x5a4d
jne 0x40b060
xor eax, eax
jmp 0x40b065
mov eax, 1
test eax, eax
je 0x40b077
mov eax, 0
jmp 0x40b206
push 0x3c
push dword [ebp + 8]
call fcn.0040b24e
push eax
call fcn.0040b228
push eax
push dword [ebp + 8]
call fcn.0040b24e
mov dword [ebp - 4], eax
push dword [ebp - 4]
call fcn.0040b228
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x4550
jne 0x40b0d2
push 0x7c
push dword [ebp - 4]
call fcn.0040b24e
push eax
call fcn.0040b228
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x40b0d2
xor eax, eax
jmp 0x40b0d7
mov eax, 1
test eax, eax
je 0x40b0e9
mov eax, 0
jmp 0x40b206
push 0x78
push dword [ebp - 4]
call fcn.0040b24e
push eax
call fcn.0040b228
push eax
push dword [ebp + 8]
call fcn.0040b24e
mov dword [ebp - 8], eax
push 0x20
push dword [ebp - 8]
call fcn.0040b24e
push eax
call fcn.0040b228
push eax
push dword [ebp + 8]
call fcn.0040b24e
push eax
call fcn.0040b228
push eax
push dword [ebp + 8]
call fcn.0040b24e
mov dword [ebp - 0xc], eax
push 0x18
push dword [ebp - 8]
call fcn.0040b24e
push eax
call fcn.0040b228
mov dword [ebp - 0x10], eax
push 1
push dword [ebp - 0x10]
call fcn.0040b275
push eax
lea eax, [ebp - 0x10]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x40b1f9
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.0040b24e
mov dword [ebp - 0x14], eax
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call fcn.0040b29c
test eax, eax
je 0x40b1dc
push 0x1c
push dword [ebp - 8]
call fcn.0040b24e
push eax
call fcn.0040b228
push eax
push dword [ebp + 8]
call fcn.0040b24e
mov dword [ebp - 0x24], eax
push 4
push dword [ebp - 0x10]
call fcn.0040b2d0
push eax
push dword [ebp - 0x24]
call fcn.0040b24e
push eax
call fcn.0040b228
push eax
push dword [ebp + 8]
call fcn.0040b24e
jmp 0x40b206
push dword [ebp - 0x14]
call fcn.0040b2f8
push eax
push dword [ebp - 0x18]
call fcn.0040b24e
mov dword [ebp - 0x18], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x40b165
add esp, 0xc
mov eax, 0
jmp 0x40b206
mov esp, ebp
pop ebp
ret 8
Function at 0x41ea37
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x41ec84
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x41eb81
cmp byte [edx + edi], 0xd
jne 0x41eb81
cmp byte [edx + edi + 1], 0xa
je 0x41ebba
mov al, byte [edx + edi]
cmp al, 0xa
je 0x41ebba
cmp al, 0x3d
jne 0x41eb96
inc ecx
cmp ecx, 2
ja 0x41ec92
cmp al, 0x7f
ja 0x41ec92
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x41ec92
cmp al, 0x40
jae 0x41ebb9
test ecx, ecx
jne 0x41ec92
inc esi
inc edx
cmp edx, ebx
jb 0x41eb6b
test esi, esi
je 0x41ec84
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x41eca3
cmp dword [ecx], eax
jb 0x41eca3
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x41ec73
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x41ec6f
cmp al, 0xa
je 0x41ec6f
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x41ec6f
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x41ec5a
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x41ec67
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x41ec6f
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x41ec0b
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x42a074
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 4]
mov eax, dword [ebp - 4]
jmp 0x42a0ab
mov esp, ebp
pop ebp
ret

Function at 0x42d1fb
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.0044ee8b
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0044ee8b
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0xc], 0
jne 0x42d29b
mov dword [ebp - 0x18], esp
mov eax, 0x54
call fcn.0044eea3
cmp dword [ebp - 0x18], esp
je 0x42d298
push 0x46
push 0x4047ae1
push 6
call fcn.0044ee9d
add esp, 0xc
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
push 0
push 0x1f0fff
mov eax, 0x52
call fcn.0044eea3
cmp dword [ebp - 0x18], esp
je 0x42d2d1
push 0x75
push 0x4047ae1
push 6
call fcn.0044ee9d
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
mov eax, 0x71
call fcn.0044eea3
cmp dword [ebp - 0x18], esp
je 0x42d309
push 0xa2
push 0x4047ae1
push 6
call fcn.0044ee9d
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push str.SeDebugPrivilege
push 0
mov eax, 0x72
call fcn.0044eea3
cmp dword [ebp - 0x18], esp
je 0x42d33f
push 0xcc
push 0x4047ae1
push 6
call fcn.0044ee9d
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x73
call fcn.0044eea3
cmp dword [ebp - 0x18], esp
je 0x42d3d8
push 0x1dc
push 0x4047ae1
push 6
call fcn.0044ee9d
add esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 0x16
call fcn.0044eea3
cmp dword [ebp - 0x18], esp
je 0x42d407
push 0x21c
push 0x4047ae1
push 6
call fcn.0044ee9d
add esp, 0xc
mov eax, dword [ebp - 0x14]
jmp 0x42d40f
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0044ee91
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.0044ee91
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8