joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x4899d8
lea edi, [edx + eax*2]
xor ebx, ebx
movzx esi, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea eax, [ebx + esi]
jne 0x4899d0
cmp eax, ebx
jb 0x489a46
cmp eax, dword [ebp + 0x10]
ja 0x489a52
add ebx, dword [ebp + 0xc]
nop word cs:[eax + eax]
nop
test esi, esi
je 0x4899d2
dec esi
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x4899c0
jmp 0x489a2f
ja 0x4899d8
cmp edx, edi
mov ebx, eax
jne 0x489992
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x489a33
mov esi, dword [ebp + 0x14]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x489a10
mov esi, edi
sub ecx, ebx
jns 0x489a27
jmp 0x489a35
cmp edi, edx
je 0x489a3c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x489a35
xor al, 1
cmp esi, edx
jne 0x4899f0
jmp 0x489a35
xor eax, eax
jmp 0x489a35
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5919e4
call sym.core::option::unwrap_failed::h400a3d34e496ce4a
push 0x5919f4
push eax
push ebx
call sym.core::slice::index::slice_index_order_fail::h40cd09a6386d1bdc
push 0x5919f4
push dword [ebp + 0x10]
push eax
call sym.core::slice::index::slice_end_index_len_fail::hb7bcdcb5c84f7e98
Function at 0x48fae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
movzx ecx, byte [ecx]
mov edx, dword [edi + 0x1c]
test dl, 0x10
jne 0x48fb35
test dl, 0x20
jne 0x48fb6d
mov eax, ecx
mov edx, ecx
sar al, 7
xor dl, al
sub dl, al
cmp dl, 0x64
jb 0x48fbc6
add dl, dl
mov esi, 0x24
add dl, 0x38
movzx eax, dl
mov dl, 1
movzx eax, word [eax + 0x591022]
mov word [ebp - 0x67], ax
jmp 0x48fbd0
xor edx, edx
lea esi, [ebp - 0xc]
mov ch, cl
nop dword [eax]
mov ebx, ecx
shr ch, 4
and bl, 0xf
mov bh, bl
mov eax, ebx
add al, 0x57
or bh, 0x30
cmp bl, 0xa
movzx ebx, bh
movzx eax, al
cmovb eax, ebx
inc edx
cmp cl, 0x10
mov cl, ch
mov byte [esi - 1], al
lea esi, [esi - 1]
jae 0x48fb40
jmp 0x48fbaa
xor edx, edx
lea esi, [ebp - 0xc]
mov ch, cl
nop word cs:[eax + eax]
nop
mov eax, ecx
shr ch, 4
and al, 0xf
mov ah, al
mov ebx, eax
add bl, 0x37
or ah, 0x30
cmp al, 0xa
movzx eax, ah
movzx ebx, bl
cmovb ebx, eax
inc edx
cmp cl, 0x10
mov cl, ch
mov byte [esi - 1], bl
lea esi, [esi - 1]
jae 0x48fb80
mov ecx, pe_nt_image_headers32
sub ecx, edx
cmp ecx, 0x81
jae 0x48fc20
push edx
push esi
push 2
push str.0x0b0o00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion_failed:_curr___19
push 1
jmp 0x48fc0c
mov esi, 0x26
cmp dl, 0xa
jae 0x48fbdc
or dl, 0x30
mov byte [ebp + esi - 0x8c], dl
jmp 0x48fbf0
movzx eax, dl
mov esi, 0x25
movzx eax, word [eax + eax + 0x591022]
mov word [ebp - 0x67], ax
xor edx, edx
test cl, cl
mov ecx, 0x27
lea eax, [ebp + esi - 0x8c]
setns dl
sub ecx, esi
push ecx
push eax
push 0
push 1
push edx
push edi
call sym.core::fmt::Formatter::pad_integral::hbe631f7bb92d6830
add esp, 0x18
add esp, 0x80
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x59100c
push pe_nt_image_headers32
push ecx
call sym.core::slice::index::slice_start_index_len_fail::h7e8587be95abf61b
Function at 0x49cbc0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov dword [0x4a60d4], eax
cmp eax, 0xffffffff
je sym._pthread_tls_init.cold.12
add esp, 0xc
ret

Function at 0x49d0d0
Capabilities:
Print debug messages

Disassembly:
test eax, eax
je 0x49d100
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [esp], eax
call sym._pthread_spin_destroy
cmp eax, 1
je 0x49d101
mov dword [ebx], 0xffffffff
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret
ret
lea ebx, [esp + 0x15]
xor eax, eax
mov esi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x3d]
mov ecx, 0x43
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
mov eax, 0x27
jne 0x49d155
jmp 0x49d163
cmp eax, 0x6a
je 0x49d16d
add eax, 1
cmp byte [ebx + eax], 0
jne 0x49d150
cmp eax, 0x6a
je 0x49d16d
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + eax + 0x16], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sym._abort
lea esi, [esi]
Function at 0x49d210
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [0x5b41b0], 1
je 0x49d225
call sym.__pthread_once_raw.part.5.constprop.11
mov eax, dword [0x4a60d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x49d250
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._pop_pthread_mem
mov ebx, eax
mov eax, dword [entry4]
test eax, eax
je 0x49d23c
test ebx, ebx
je 0x49d23c
mov dword [ebx + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x18], eax
sub esp, 0x10
lea eax, [ebx + 0x38]
call sym._replace_spin_keys.constprop.10
mov esi, dword [sym.imp.kernel32.dll_GetCurrentProcess]
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call esi
mov ebp, eax
call dword [sym.imp.kernel32.dll_GetCurrentThread]
mov edi, eax
call esi
lea edx, [ebx + 0x14]
mov dword [esp + 8], ebp
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je sym.___pthread_self_lite.cold.13
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x4a60d4]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je sym.___pthread_self_lite.cold.13
add esp, 0x2c
mov esi, ebx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x49d490
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x49d4c0
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x49d570
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x49d5a0
cmp eax, 3
jne 0x49d4aa
mov eax, dword [0x4a60d4]
cmp eax, 0xffffffff
je 0x49d4aa
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x49d4aa
test byte [eax + 0x20], 0x30
je 0x49d5d0
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x49d503
call sym.__pthread_cleanup_dest.part.8
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x49d535
mov dword [esp], eax
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x49d527
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
lea eax, [ebx + 0x38]
call sym._replace_spin_keys.constprop.10
mov eax, ebx
call sym._push_pthread_mem
mov eax, dword [0x4a60d4]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
jmp 0x49d4aa
mov eax, dword [0x5b418c]
test eax, eax
je 0x49d4aa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x5b418c], 0
sub esp, 4
jmp 0x49d4aa
mov dword [esp + 4], sym._SetThreadName_VEH_4
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x5b418c], eax
mov eax, 1
add esp, 0x10
pop ebx
pop esi
pop edi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x49d642
test eax, eax
je 0x49d5ea
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x49d607
call sym.__pthread_cleanup_dest.part.8
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
test byte [ebx + 0x24], 4
je 0x49d671
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x49d62c
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call sym._pthread_mutex_destroy
mov eax, esi
jmp 0x49d543
test eax, eax
je 0x49d652
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call sym._pthread_mutex_destroy
lea eax, [ebx + 0x38]
call sym._replace_spin_keys.constprop.10
jmp 0x49d4aa
mov dword [esp], edi
call sym._pthread_mutex_destroy
mov eax, esi
call sym._replace_spin_keys.constprop.10
jmp 0x49d4aa
Function at 0x49d690
Capabilities:
Set thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov eax, dword [ecx]
mov esi, eax
mov dword [ebp - 0x1c], eax
call sym.__fpreset
mov dword [esp], 0x4a60cc
lea ebx, [esi + 0x1c]
call sym._pthread_mutex_lock
mov dword [esp], ebx
call sym._pthread_mutex_lock
cmp dword [0x5b41b0], 1
je 0x49d6d5
call sym.__pthread_once_raw.part.5.constprop.11
mov esi, dword [ebp - 0x1c]
mov eax, dword [0x4a60d4]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp], ebx
call sym._pthread_mutex_unlock
lea eax, [esi + 0x70]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym.__setjmp3
test eax, eax
je 0x49d7a3
mov dword [esp], 0x4a60cc
call sym._pthread_mutex_lock
mov esi, dword [ebp - 0x1c]
lea ebx, [esi + 0x1c]
mov dword [esp], ebx
call sym._pthread_mutex_lock
mov eax, esi
mov esi, dword [esi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x49d748
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push ecx
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
je 0x49d7ed
mov dword [esp], ebx
call sym._pthread_mutex_unlock
mov dword [esp], ebx
call sym._pthread_mutex_destroy
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x1c], 0xffffffff
mov dword [eax + 0x68], 1
mov ebx, dword [sym.imp.kernel32.dll_Sleep]
mov dword [esp], 0x4a60cc
call sym._pthread_mutex_unlock
test eax, eax
jne 0x49d831
mov dword [esp], 0
call ebx
push eax
jmp 0x49d783
mov dword [esp], 0x4a60cc
call sym._pthread_mutex_unlock
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
test eax, eax
je 0x49d82a
mov edx, dword [edx + 4]
mov dword [esp], edx
call eax
mov ebx, eax
mov dword [esp], 0x4a60cc
call sym._pthread_mutex_lock
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], ebx
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x49d724
call sym.__pthread_cleanup_dest.part.8
jmp 0x49d724
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0xdeadbeef
mov dword [esp], ebx
call sym._pthread_mutex_unlock
mov dword [esp], ebx
call sym._pthread_mutex_destroy
mov eax, edi
call sym._push_pthread_mem
mov eax, dword [0x4a60d4]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push edx
push edx
jmp 0x49d77d
mov ebx, pe_nt_image_headers32
jmp 0x49d7c3
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
lea esi, [esi]
Function at 0x49e000
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x49e022
call sym.__pthread_cleanup_dest.part.8
test byte [ebx + 0x20], 0x30
jne 0x49e03b
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
mov eax, dword [0x4a60d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x49e07e
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x49e0c2
mov esi, dword [ebx + 4]
mov dword [ebx + 0x68], 1
test eax, eax
je 0x49e071
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push ecx
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x49e087
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push edx
mov dword [ebx + 0x14], 0
mov eax, ebx
call sym._push_pthread_mem
mov eax, dword [0x4a60d4]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push eax
push eax
jmp 0x49e07e
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x49e0d6
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push esi
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jmp 0x49e0a1

Function at 0x4a1bb0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x4a1c10
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x5b41f0]
test esi, esi
jle 0x4a1d30
mov edi, dword [0x5b41f4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4a1c44
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x4a1cc9
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x4a1c30
mov dword [esp], eax
mov ebx, eax
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x4a1d57
mov eax, dword [0x5b41f4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x5b41f4]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4a1d37
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4a1cc2
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4a1cd0
add dword [0x5b41f0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x5b41f4]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4a1cc2
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
lea edi, [edi]
xor esi, esi
jmp 0x4a1c4e
mov eax, dword [0x5b41f4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
mov esi, esi
lea edi, [edi]

Function at 0x4a2250
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x5b420c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x5b4204]
sub esp, 4
test ebx, ebx
je 0x4a22a5
mov ebp, dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4a229e
test esi, esi
je 0x4a229e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4a2280
mov dword [esp], 0x5b420c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x4a92f7d
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x3dde0b99
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4029f0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x48]
mov esi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x4c]
test ebx, ebx
js 0x402a90
test ebp, ebp
js 0x402a80
shl ebp, 0x10
movzx ebx, bx
or ebx, ebp
test edi, edi
js 0x402a5a
mov dword [esp], 0
lea ebp, [esp + 0x18]
call fcn.00402900
mov dword [esp + 4], ebp
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
xor eax, eax
sub esp, 8
test edi, edi
setne al
mov dword [esp + 4], ebp
mov dword [esp + 0x1c], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [0x41a38c], 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
sub esp, 8
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call fcn.00405bc0
mov ebp, eax
jmp 0x402a13
mov dword [esp], esi
call fcn.00405b20
mov ebx, eax
jmp 0x402a0f
Function at 0x405d90
Capabilities:
Log keystrokes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
test dword [esp + 0x4c], 0x100
je 0x405db3
mov ebx, edi
test bl, bl
je 0x405de8
cmp si, 0x58
jbe 0x405e20
mov eax, dword [esp + 0x50]
test eax, eax
je 0x405dd0
mov ebx, 0xffffffff
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
movzx ebx, al
test al, al
je 0x405dc1
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, esi
mov edx, 0x1c
xor eax, eax
jmp 0x405e03
lea edx, [eax + eax*4]
movzx edx, word [edx + edx + 0x40f5e0]
cmp cx, dx
je 0x405ed0
add eax, 1
cmp eax, 0xc
jne 0x405df8
jmp 0x405dc1
movzx esi, si
movzx eax, ax
mov dword [esp + 4], 2
lea ecx, [esi*8 + 0x40f300]
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx ebp, ax
sub esp, 8
mov dword [esp], ebp
mov ebx, ebp
call dword [sym.imp.msvcrt.dll_isupper]
mov dword [esp], ebp
test eax, eax
jne 0x405eb0
call dword [sym.imp.msvcrt.dll_islower]
mov ecx, eax
mov eax, ebp
test ecx, ecx
je 0x405e71
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll_toupper]
test byte [esp + 0x4c], 3
je 0x405ebd
mov esi, dword [esp + 0x1c]
movzx ebx, word [esi + 6]
cmp ebx, 0xff
jle 0x405db9
mov ecx, edi
movzx ecx, cl
cmp ecx, ebp
je 0x405e9d
cmp eax, ecx
jne 0x405db9
or bl, 0xff
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.msvcrt.dll_tolower]
test byte [esp + 0x4c], 3
jne 0x405e78
test byte [esp + 0x4c], 0xc
je 0x405f10
mov esi, dword [esp + 0x1c]
movzx ebx, word [esi + 4]
jmp 0x405e80
lea eax, [eax + eax*4]
lea eax, [eax + eax + 0x40f5e0]
test byte [esp + 0x4c], 3
jne 0x405f30
test byte [esp + 0x4c], 0xc
je 0x405f50
movzx ebx, word [eax + 6]
xor eax, eax
test ebx, ebx
setne al
test eax, eax
je 0x405dc1
cmp ebx, 0xff
jle 0x405dc6
or bl, 0xff
jmp 0x405ea0
test byte [esp + 0x4c], 0x10
jne 0x405f40
mov ecx, edi
test cl, cl
jne 0x405e80
movzx ebx, word [esi*8 + 0x40f300]
jmp 0x405e80
movzx ebx, word [eax + 8]
xor eax, eax
test ebx, ebx
setne al
jmp 0x405ef3
mov esi, dword [esp + 0x1c]
movzx ebx, word [esi + 2]
jmp 0x405e80
test byte [esp + 0x4c], 0x10
je 0x405f64
movzx ebx, word [eax + 4]
xor eax, eax
test ebx, ebx
setne al
jmp 0x405ef3
movzx ebx, word [eax + 2]
jmp 0x405efb
Function at 0x405f70
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x38
mov edx, dword [ebx]
mov eax, dword [eax + 0xc]
test edx, edx
jne 0x406030
test al, 0x1c
jne 0x405f8f
test al, 3
jne 0x406022
mov ebx, dword [0x4124c8]
test ebx, ebx
je 0x406022
movsx eax, bl
mov dword [esp], eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
sub esp, 4
movzx ecx, al
cwde
mov dword [esp + 0x28], 0
mov edx, eax
mov byte [esp + 0x2a], bl
mov ebx, eax
sar edx, 4
sar ebx, 6
and edx, 0x10
sar eax, 9
mov dword [esp], ecx
and ebx, 8
and eax, 2
mov dword [esp + 0x24], 0
or edx, ebx
mov word [esp + 0x26], cx
or eax, edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
sub esp, 8
mov word [esp + 0x28], ax
movzx eax, byte [0x4124c8]
lea edx, [esp + 0x20]
call fcn.00405c60
mov dword [0x4124c8], 0
add esp, 0x38
pop ebx
ret
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 6]
mov dword [esp + 8], eax
movzx eax, word [ebx + 8]
mov dword [esp + 4], eax
movsx eax, byte [ebx + 0xa]
mov dword [esp], eax
call fcn.00405d90
mov edx, dword [ebx + 0xc]
test dl, 0x1c
je 0x40607f
cmp eax, 0xffffffff
je 0x405f8f
mov dword [0x4124c8], 0
mov edx, ebx
call fcn.00405c60
add esp, 0x38
pop ebx
ret
and dl, 3
je 0x406060
movzx edx, word [ebx + 6]
lea ecx, [edx - 0x60]
cmp cx, 9
ja 0x4060b4
mov ecx, dword [ebx]
test ecx, ecx
je 0x4060aa
mov ecx, dword [0x4124c8]
lea ecx, [ecx + ecx*4]
lea edx, [edx + ecx*2 - 0x60]
mov dword [0x4124c8], edx
cmp eax, 0xffffffff
jne 0x406073
jmp 0x406022
cmp eax, 0xffffffff
jne 0x406069
jmp 0x406022