joyce8/EMBER2024-capa huggingface dataset:
Function at 0x805c78
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805c7e
pop ebp
sub ebp, 6
sub ebp, 0x405c78
jmp 0x805cdc
jmp 0x805ce5
mov eax, 0x405c78
add eax, ebp
add eax, 0x93
mov ecx, 0x62b
mov edx, 0xa43c9a69
xor byte [eax], dl
inc eax
dec ecx
jne 0x805cfc
jmp 0x805d0f
add ebp, dword [ecx]
add dword [ecx + 0x79], ebp
imul ebp, dword [ecx + 1], 0x6945a569
imul eax, dword [ecx], 0x6945a569
call 0x6801abb9
std
call 0x6801abbf
std
pop edx
test eax, 0x69fc9639
mov eax, 0xe239695f
movsb byte es:[edi], byte [esi]
loop 0x805d15
push ebp
imul ebp, dword [ecx + 0x69], 0x6991a8e8
imul ebp, dword [ecx + 0x6a], 0x696fd1a4
imul ebp, dword [ecx - 0x2d], 0x69696941
call 0x69e9eee6
imul ebp, dword [edx - 0x5c], 0x69696fd1
imul edx, ebx, 0x69696941
sahf
mov ebp, dword [edx - 0x5f]
loop 0x805d39
imul ebp, dword gs:[ecx + 0x69], 0x139ac6a
mov al, byte [0x169605d]
les ecx, [esi + 0x5e]
imul ebp, dword [eax + 0x45], 0x6969014d
imul ebp, dword [ecx - 0x7f], 0x6969696c
add byte [ebx + 0x69], 0x69
imul edi, dword [esp], 0xe2694d05
in al, dx
popal
imul ebp, dword [ecx + 0x69], 0x6965fce2
imul ebp, dword [ecx - 0x1e], 0x696979e4
imul ebp, dword [eax + 0x6b586b80], 0x206dabea
in al, dx
popfd
xchg esi, eax
xchg esi, eax
xchg esi, eax
xor al, 0xab
imul esp, edx, 0x696d4de5
imul ebp, dword [ecx + 1], 0x69605da0
add esp, eax
dec esi
pop esi
imul ebp, dword [eax + 0x45], 0x6c81384d
imul ebp, dword [ecx + 0x69], 0x696b5c80
imul edi, dword [esp], 0x96694d05
sbb al, 0x65
xchg esi, eax
sbb al, 0x61
or dword [edi], 0xe2696969
aam 0x61
imul ebp, dword [ecx + 0x69], 0xbb5aa05a
ljmp 0x27ed
Function at 0x80d2a0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x80d2a6
pop ebp
sub ebp, 0x45b54c
lea edi, [ebp + 0x45d155]
mov esi, edi
mov ecx, 0x92
xor ebx, ebx
lodsb al, byte [esi]
xor al, 0x44
sub al, bl
rol al, 2
stosb byte es:[edi], al
inc ebx
loop 0x80d2bc
mov eax, dword [esp + 0x20]
inc eax
js 0x80d2d9
mov dword [ebp + 0x45d159], 1
cmp dword [ebp + 0x45d159], 0
jne 0x80d2e4
jmp 0x80d2fa
push ebp
lea eax, [ebp + 0x45b5c2]
push eax
mov eax, 0x30
push eax
call fcn.0080d389
pop ebp
jmp 0x80d30e
push ebp
lea eax, [ebp + 0x45b5c2]
push eax
mov eax, 0x30
push eax
call fcn.0080d616
pop ebp
mov ecx, 0x17a7
lea edi, [ebp + 0x45b9ae]
mov esi, edi
lodsb al, byte [esi]
clc
mov ah, 0x5b
mov eax, dword [ecx]
shr ebx, 0x1f
inc edx
invalid
Function at 0x80d389
Capabilities:
Check for trap flag exception

Disassembly:
mov ebp, esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add ecx, dword [ebx + 0x33020875]
fild dword [esi]
mov edx, 0x8b030001
dec ebp
add al, 3
mov edi, dword [ebp + 0xc]
push es
lea edi, [edi + 0x45d155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add cl, byte [edx + 0x7d8b0306]
or al, 6
lea edi, [edi + 0x45d155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
push ebx
push ecx
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add dh, byte [ecx + 0x7d8b0300]
or al, 6
lea edi, [edi + 0x45d155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add dh, byte [ebx]
fild dword [ebx]
mov bx, dx
add al, 0x66
and ebx, 1
add dl, dl
jecxz 0x80d4d1
xor al, bl
add esp, dword [esi - 0x2f]
loop 0x80d4d9
mov bx, dx
add eax, 0xe38166
add byte [edx], 0xb5
add byte [ebx], 0x8b
jge 0x80d4f2
push es
lea edi, [edi + 0x45d155]
push es
mov dword [edi], 0
add byte [eax], al
pop dword fs:[0]
add esp, 4
cmp bh, ch
jne 0x80d556
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add eax, 0x3f28166
add byte [ebx], 0x8b
jge 0x80d54a
push es
lea edi, [edi + 0x45d155]
push es
mov dword [edi], 0
add byte [eax], al
pop dword fs:[0]
add esp, 4
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add bh, dh
rol dword [edx], 0xb5
or byte [ebx], al
mov edi, dword [ebp + 0xc]
push es
lea edi, [edi + 0x45d155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
cmp cl, ch
jne 0x80d48d
pop ecx
pop ebx
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add cl, byte [eax + 0x1460106]
inc ebx
add ecx, dword [ebx - 0x72f9f383]
mov edi, 0x45d155
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
cmp ecx, ebx
jne 0x80d3e9
mov esp, ebp
ret 8
Function at 0x80d616
Capabilities:
Check for trap flag exception

Disassembly:
mov ebp, esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d1aa]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add ecx, dword [ebx + 0x33020875]
fild dword [esi]
mov edx, 0x8b030001
jge 0x80d666
push es
lea edi, [edi + 0x45d155]
push es
mov dword [edi], 0
add byte [eax], al
pop dword fs:[0]
add esp, 4
mov ecx, dword [ebp + 4]
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d1aa]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45d155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add cl, byte [edx + 0x7d8b0306]
or al, 6
lea edi, [edi + 0x45d155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
push ebx
push ecx
mov cl, 0
xor ebx, ebx
mov bx, dx
and bx, 1
shl bl, cl
xor al, bl
shl dx, 1
mov bx, dx
and bx, 0x8000
mov ch, 0x80
cmp bh, ch
jne 0x80d6ed
xor dx, 0x8003
inc cl
mov ch, 8
cmp cl, ch
jne 0x80d6ca
pop ecx
pop ebx
mov byte [esi], al
inc esi
inc ebx
cmp ecx, ebx
jne 0x80d675
mov esp, ebp
ret 8
Function at 0x17eb058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.017eb1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x17eb07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17eb06a
add dl, dl
jne 0x17eb089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17eb0dc
xor eax, eax
add dl, dl
jne 0x17eb096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17eb17d
add dl, dl
jne 0x17eb0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17eb0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17eb0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17eb0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x17eb0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x17eb075
mov eax, 1
add dl, dl
jne 0x17eb0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17eb0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17eb0e1
sub eax, ebx
mov ebx, 1
jne 0x17eb128
mov ecx, 1
add dl, dl
jne 0x17eb10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x17eb119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17eb105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17eb075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x17eb13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x17eb14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17eb136
cmp eax, 0x7d00
jae 0x17eb16d
cmp eax, 0x500
jb 0x17eb168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17eb075
cmp eax, 0x7f
ja 0x17eb170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17eb075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x17eb19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x17eb075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403cc0
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, dl
xor eax, ecx
imul eax, eax, 0x1000193
ret
Function at 0x4089d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x4089fc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x408a7e
jg 0x408a24
test esi, esi
je 0x408a7e
test ecx, ecx
jl 0x408a79
jg 0x408a2e
test eax, eax
je 0x408a79
cmp edi, ecx
jg 0x408a42
jl 0x408a38
cmp esi, eax
jae 0x408a42
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.00409ff0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, ecx
sub esi, ecx
mov dword [esp + 0x10], eax
sbb edi, dword [esp + 0x14]
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
mov eax, dword [esp + 0x10]
jmp 0x408a81
mov eax, dword [ebp + 8]
jmp 0x408a8b
mov eax, dword [ebp + 8]
test edi, edi
jl 0x408aa5
jg 0x408a8b
test esi, esi
je 0x408aa5
mov ecx, dword [ebx + 0x4c]
test ecx, ecx
je 0x408aa5
push ecx
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408ac0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x44500c]
xor eax, esp
mov dword [esp + 8], eax
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, ecx
test esi, esi
jg 0x408b03
jl 0x408aea
test ebp, ebp
jne 0x408b03
pop edi
pop esi
pop ebp
xor eax, eax
xor edx, edx
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004398d9
add esp, 0xc
ret 0xc
cmp dword [edi + 0x38], 0
je 0x408b27
push esi
push ebp
push ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004398d9
add esp, 0xc
ret 0xc
mov dword [esp + 0x10], ebp
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [esp + 0x14], eax
test eax, eax
je 0x408b6e
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
call fcn.00408c00
mov ecx, edi
mov esi, dword [eax]
push esi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push eax
push ebx
call fcn.00409ff0
sub dword [esp + 0x1c], esi
add esp, 0xc
mov ecx, edi
add ebx, esi
push esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov esi, dword [esp + 0x28]
cmp dword [edi + 0x4c], 0
je 0x408bd4
mov ecx, edi
call fcn.00409820
mov ecx, dword [esp + 0x10]
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp ecx, 0xfff
jbe 0x408bbc
nop dword [eax]
push dword [edi + 0x4c]
push 0xfff
push 1
push ebx
call eax
mov ecx, dword [esp + 0x20]
add esp, 0x10
sub ecx, eax
add ebx, eax
mov dword [esp + 0x10], ecx
cmp eax, 0xfff
jne 0x408bd8
cmp ecx, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x408b90
test ecx, ecx
je 0x408bd8
push dword [edi + 0x4c]
push ecx
push 1
push ebx
call eax
mov ecx, dword [esp + 0x20]
add esp, 0x10
sub ecx, eax
jmp 0x408bd8
mov ecx, dword [esp + 0x10]
sub ebp, ecx
mov ecx, dword [esp + 0x18]
pop edi
sbb esi, 0
mov eax, ebp
mov edx, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004398d9
add esp, 0xc
ret 0xc
Function at 0x408fa0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x44500c]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push edi
mov edi, ecx
call fcn.00409f90
mov ebx, eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
push eax
call fcn.00409fc0
add esp, 8
test al, al
je 0x408fef
lea ecx, [esp + 0x3c]
call fcn.00409fa0
pop edi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004398d9
add esp, 0x30
ret 4
push esi
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
test eax, eax
je 0x409043
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const]
mov ecx, edi
mov esi, eax
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
cmp eax, esi
jae 0x409043
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov esi, eax
lea eax, [esp + 0x40]
push eax
call fcn.00409120
add esp, 4
mov byte [esi], al
mov eax, dword [esp + 0x40]
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004398d9
add esp, 0x30
ret 4
cmp dword [edi + 0x4c], 0
je 0x409102
mov ecx, edi
call fcn.00409820
mov esi, dword [edi + 0x38]
lea eax, [esp + 0x40]
push eax
call fcn.00409120
add esp, 4
test esi, esi
jne 0x40907e
mov edx, dword [edi + 0x4c]
mov cl, al
call fcn.00403950
test al, al
cmovne ebx, dword [esp + 0x40]
jmp 0x409102
mov byte [esp + 0x17], al
mov ecx, esi
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x2b]
push eax
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x4090d0
sub eax, 1
je 0x4090d0
sub eax, 2
jne 0x409102
mov edx, dword [edi + 0x4c]
mov cl, byte [esp + 0x17]
call fcn.00403950
test al, al
cmovne ebx, dword [esp + 0x40]
jmp 0x409102
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x18]
sub esi, eax
je 0x4090f0
push dword [edi + 0x4c]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x409102
lea eax, [esp + 0x17]
mov byte [edi + 0x3d], 1
cmp dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
jne 0x409104
mov eax, ebx
mov ecx, dword [esp + 0x38]
pop esi
pop edi
pop ebx
xor ecx, esp
call fcn.004398d9
add esp, 0x30
ret 4
Function at 0x409890
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x44500c]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x409979
cmp byte [ebx + 0x3d], 0
je 0x409979
mov eax, dword [ebx]
push esi
push edi
mov esi, dword [eax + 0xc]
call fcn.00409f90
mov edi, eax
mov ecx, ebx
push edi
call esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edi
push eax
call fcn.00409fc0
add esp, 8
test al, al
jne 0x409965
mov ecx, dword [ebx + 0x38]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [ebx + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x409928
sub eax, 1
je 0x40992c
sub eax, 2
jne 0x409965
pop edi
mov byte [ebx + 0x3d], al
mov al, 1
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004398d9
add esp, 0x30
ret
mov byte [ebx + 0x3d], 0
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x18]
sub esi, eax
je 0x40994c
push dword [ebx + 0x4c]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x409965
cmp byte [ebx + 0x3d], 0
pop edi
pop esi
sete al
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004398d9
add esp, 0x30
ret
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004398d9
add esp, 0x30
ret
mov ecx, dword [esp + 0x30]
mov al, 1
pop ebx
xor ecx, esp
call fcn.004398d9
add esp, 0x30
ret

Function at 0x410a40
Capabilities:
Create thread

Disassembly:
sub esp, 8
mov eax, dword [0x44500c]
xor eax, esp
mov dword [esp + 4], eax
push esi
push edi
push ecx
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.0040a050
mov ecx, dword [esp + 0x14]
call fcn.00409310
mov edx, eax
lea ecx, [esp + 8]
call fcn.00410cc0
lea edi, [esi + 4]
push edi
push 0
lea ecx, [esp + 0x10]
call fcn.00410780
push eax
push 0x410d00
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x410abd
lea ecx, [esp + 8]
call fcn.00410180
lea ecx, [esp + 8]
call fcn.00410b70
mov ecx, dword [esp + 0xc]
pop edi
pop esi
xor ecx, esp
call fcn.004398d9
add esp, 8
ret 4
push 6
mov dword [edi], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x419200
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4c
mov eax, dword [0x44500c]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4192e9
push 0xf
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x419295
mov byte [esp + 4], 0
lea ecx, [esp + 0x10]
push dword [esp + 4]
mov byte [esp + 0xc], 0
push dword [esp + 0xc]
mov byte [esp + 0x14], 0
push dword [esp + 0x14]
call fcn.0041b550
mov ecx, eax
call fcn.0041adf0
push eax
lea ecx, [esp + 0x38]
call fcn.00409580
push 0x22
push 0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x40]
call fcn.00409320
push eax
lea ecx, [esp + 0x38]
call fcn.00409510
lea ecx, [esp + 0x10]
call fcn.00409500
lea ecx, [esp + 0x34]
call fcn.00409500
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [ebp + 8]
call fcn.00409370
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4192e3
lea ecx, [ebp + 8]
call fcn.00409370
inc eax
push eax
call fcn.00409380
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp + 8]
call fcn.00409500
mov ecx, dword [esp + 0x4c]
pop esi
xor ecx, esp
call fcn.004398d9
mov esp, ebp
pop ebp
ret

Function at 0x419310
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x20
mov eax, dword [0x44500c]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x419396
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x419396
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x419396
push dword [0x4457e4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push ebx
lea ecx, [esp + 0x10]
call fcn.00409580
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.00409540
lea ecx, [esp + 0xc]
call fcn.00409500
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004398d9
add esp, 0x20
ret
push 0x43b4bd
mov ecx, esi
call fcn.00409580
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004398d9
add esp, 0x20
ret
Function at 0x419e40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [0x44500c]
xor eax, esp
mov dword [esp + 0x4c], eax
call fcn.0041c120
mov ecx, 0x44587c
mov edx, eax
call fcn.00409270
push eax
push 1
push 0
call edx
push 0x3c
mov dword [0x4457f4], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x419ee1
mov byte [esp + 4], 0
lea ecx, [esp + 0x10]
push dword [esp + 4]
mov byte [esp + 0xc], 0
push dword [esp + 0xc]
mov byte [esp + 0x14], 0
push dword [esp + 0x14]
call fcn.0041c1a0
mov ecx, eax
call fcn.0041adf0
push eax
lea ecx, [esp + 0x38]
call fcn.00409580
push 8
push 0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x40]
call fcn.00409320
push eax
lea ecx, [esp + 0x38]
call fcn.00409510
lea ecx, [esp + 0x10]
call fcn.00409500
lea ecx, [esp + 0x34]
call fcn.00409500
call fcn.0041c1e0
push 0
push dword [0x4457f4]
call eax
test eax, eax
je 0x419f00
call fcn.0041c260
push 1
call eax
add esp, 4
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.004398d9
mov esp, ebp
pop ebp
ret
Function at 0x43a380
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43a3bf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43a3bf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43a3bf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43a3bf
cmp dword [ecx + 0x74], 0xe
jbe 0x43a3bf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x54846e
Capabilities:
Encode data using xor

Disassembly:
call fcn.00549414
call fcn.00542c4a
stosd dword es:[edi], eax
xor al, byte [ecx + 0x37]
daa
ror byte [edx + edi*2], 1
cmp al, 0xd5
invalid