joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47cfac
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404b3c
xor eax, eax
push ebp
push 0x47d124
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebx + 4]
xor edx, edx
mov dword [eax + 0x38], edx
mov eax, dword [ebp - 8]
call fcn.0040468c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0047d67c
mov esi, 0x84000000
mov eax, dword [ebp - 0x10]
mov edx, 0x47d140
call fcn.00404a98
jne 0x47d024
mov esi, 0x80f000
cmp byte [ebx + 0xc], 0
jne 0x47d030
or esi, 0x200000
push 0
push 0
push 3
push 0x47d148
push 0x47d148
mov ax, word [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404b4c
push eax
mov eax, dword [ebx + 0x18]
push eax
call sub.wininet.dll_InternetConnectA
mov edi, eax
push 0
push esi
push 0
push 0x47d148
push 0x47d14c
mov eax, dword [ebp - 0x18]
call fcn.00404b4c
push eax
push 0x47d158
push edi
call sub.wininet.dll_HttpOpenRequestA
mov esi, eax
push 4
lea eax, [ebx + 0x10]
push eax
push 2
push esi
call sub.wininet.dll_InternetSetOptionA
push 4
lea eax, [ebx + 0x10]
push eax
push 5
push esi
call sub.wininet.dll_InternetSetOptionA
push 4
lea eax, [ebx + 0x10]
push eax
push 6
push esi
call sub.wininet.dll_InternetSetOptionA
mov eax, dword [ebx + 4]
xor edx, edx
mov dword [eax + 0x2c], edx
mov ecx, 0x47d164
mov edx, esi
mov eax, ebx
call fcn.0047d818
xor eax, eax
mov dword [ebx + 0x14], eax
push 0
push 0
push 0
push 0x47d148
push esi
call sub.wininet.dll_HttpSendRequestA
test eax, eax
jne 0x47d0e2
call sub.kernel32.dll_GetLastError_1
mov dword [ebx + 0x14], eax
jmp 0x47d101
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, esi
mov eax, ebx
call fcn.0047dc60
mov byte [ebp - 9], al
push esi
call sub.wininet.dll_InternetCloseHandle
push edi
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d12b
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004046b0
lea eax, [ebp - 4]
call fcn.0040468c
ret
Function at 0x47d67c
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff7b0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1850], ebx
mov dword [ebp - 0x1848], ebx
mov dword [ebp - 0x184c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00404b3c
lea edi, [ebp - 0x44]
xor eax, eax
push ebp
push 0x47d7fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x47d814
call fcn.00404c90
mov ebx, eax
test ebx, ebx
jle 0x47d6ec
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404bac
mov dword [edi], 0x3c
lea eax, [ebp - 0x1044]
mov dword [edi + 4], eax
mov dword [edi + 8], 0x400
lea eax, [ebp - 0x444]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0x400
lea eax, [ebp - 0x844]
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], 0x400
lea eax, [ebp - 0xc44]
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], 0x400
lea eax, [ebp - 0x1444]
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], 0x400
lea eax, [ebp - 0x1844]
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], 0x400
push edi
push 0
mov eax, dword [ebp - 4]
call fcn.0040494c
push eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
push eax
call sub.wininet.dll_InternetCrackUrlA
test eax, eax
je 0x47d7d6
lea eax, [ebp - 0x184c]
mov edx, dword [edi + 4]
call fcn.00404884
mov eax, dword [ebp - 0x184c]
lea edx, [ebp - 0x1848]
call fcn.00408728
mov edx, dword [ebp - 0x1848]
mov eax, dword [ebp - 8]
call fcn.004046e0
mov eax, dword [ebp + 0x10]
mov edx, dword [edi + 0x10]
call fcn.00404884
mov eax, esi
mov edx, dword [edi + 0x2c]
call fcn.00404884
lea eax, [ebp - 0x1850]
mov edx, dword [edi + 0x34]
call fcn.00404884
mov edx, dword [ebp - 0x1850]
mov eax, esi
call fcn.00404954
movzx eax, word [edi + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d803
lea eax, [ebp - 0x1850]
mov edx, 3
call fcn.004046b0
lea eax, [ebp - 4]
call fcn.0040468c
ret
Function at 0x47dc60
Capabilities:
Check http status code
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x824], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x47de32
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x16
push ebx
call sub.wininet.dll_HttpQueryInfoA
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00404cd8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404b4c
push eax
push 0x16
push ebx
call sub.wininet.dll_HttpQueryInfoA
mov edx, dword [ebp - 0x18]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x20000013
push ebx
call sub.wininet.dll_HttpQueryInfoA
mov eax, dword [esi + 4]
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x38], edx
cmp dword [ebp - 0x14], 0xc8
je 0x47dd21
cmp dword [ebp - 0x14], 0x12e
jne 0x47de0c
mov byte [ebp - 5], 1
cmp dword [ebp - 4], 0
je 0x47de0c
lea eax, [ebp - 0x81d]
xor ecx, ecx
mov edx, 0x800
call fcn.004030bc
cmp dword [ebp - 4], 0xffffffff
jne 0x47dd9d
jmp 0x47dd81
cmp dword [ebp - 0x10], 0
je 0x47de0c
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x81d], 0
lea eax, [ebp - 0x824]
lea edx, [ebp - 0x81d]
mov ecx, 0x801
call fcn.004048fc
mov edx, dword [ebp - 0x824]
mov eax, edi
call fcn.00404954
lea eax, [ebp - 0x10]
push eax
push 0x800
lea eax, [ebp - 0x81d]
push eax
push ebx
call sub.wininet.dll_InternetReadFile
test eax, eax
jne 0x47dd49
jmp 0x47de0c
mov dword [ebp - 0x1c], 0x800
cmp dword [ebp - 4], 0x800
jge 0x47ddb3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
xor esi, esi
jmp 0x47ddf3
cmp dword [ebp - 0x10], 0
je 0x47de0c
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x81d], 0
lea eax, [ebp - 0x828]
lea edx, [ebp - 0x81d]
mov ecx, 0x801
call fcn.004048fc
mov edx, dword [ebp - 0x828]
mov eax, edi
call fcn.00404954
add esi, dword [ebp - 0x10]
cmp esi, dword [ebp - 4]
jge 0x47de0c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x81d]
push eax
push ebx
call sub.wininet.dll_InternetReadFile
test eax, eax
jne 0x47ddb7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47de39
lea eax, [ebp - 0x828]
mov edx, 2
call fcn.004046b0
lea eax, [ebp - 0x18]
call fcn.0040468c
ret
Function at 0x4854b4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4854bc
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4856ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4856c4
mov eax, esi
call fcn.00483340
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004046e0
lea ecx, [ebp - 0x10]
mov edx, 0x4856d8
mov eax, esi
call fcn.00483340
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004046e0
lea ecx, [ebp - 0x14]
mov edx, 0x4856f0
mov eax, esi
call fcn.00483340
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004046e0
lea ecx, [ebp - 0x18]
mov edx, 0x48570c
mov eax, esi
call fcn.00483340
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004046e0
lea ecx, [ebp - 0x1c]
mov edx, 0x485728
mov eax, esi
call fcn.00483340
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004046e0
lea ecx, [ebp - 0x24]
mov edx, 0x485740
mov eax, esi
call fcn.00483340
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408838
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408d80
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x485758
mov eax, esi
call fcn.00483340
mov eax, dword [ebp - 0x28]
call fcn.0047b9b0
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x485768
mov eax, esi
call fcn.00483340
mov eax, dword [ebp - 0x2c]
call fcn.0047b9b0
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x485780
mov eax, esi
call fcn.00483340
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408d80
inc eax
je 0x485651
lea ecx, [ebp - 0x34]
mov edx, 0x485780
mov eax, esi
call fcn.00483340
mov eax, dword [ebp - 0x34]
call fcn.00408d44
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a798
fstp qword [ebp - 0x3c]
wait
call fcn.0040aafc
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x48566c
lea ecx, [ebp - 0x40]
mov edx, 0x485780
mov eax, esi
call fcn.00483340
mov eax, dword [ebp - 0x40]
call fcn.0047b9b0
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x485790
mov eax, esi
call fcn.00483340
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004046e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4856b5
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004046b0
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004046b0
ret
Function at 0x48c440
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x48c49a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0048c430
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0047a614
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0047a214
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c4a1
lea eax, [ebp - 4]
call fcn.0040468c
ret

Function at 0x49275c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, edx
push 0
push eax
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004048fc
cmp dword [ebx], 0
je 0x4927a3
mov eax, dword [ebx]
call fcn.0040494c
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4927a3
mov eax, ebx
mov edx, 0x4927b4
call fcn.00404954
add esp, 0x108
pop ebx
ret

Function at 0x495988
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4959b6
mov eax, ebx
call fcn.0049643c
cmp dword [ebx + 0x40], 0
je 0x4959af
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x495a27
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x495a19
cmp dword [ebx + 8], 0
je 0x4959d8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4959ea
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x495a19
cmp dword [ebx + 8], 0
je 0x4959cb
cmp eax, 3
je 0x4959fd
dec eax
jne 0x4959cb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4959cb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4959cb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x495a45
cmp dword [ebx + 0x14], 0xcc
je 0x495a45
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00495a50
pop ebx
ret
Function at 0x427eff
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43d230]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0041bf0c
mov dword [ebp - 0x14], eax
cmp dword [0x440d04], esi
jne 0x427ff2
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x427f7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4280d2
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4280d2
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4280d2
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x440d04], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x440d08], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x440d0c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x440d14], eax
test eax, eax
je 0x427fef
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x440d10], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x428017
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x42800a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x42802c
push 4
pop eax
jmp 0x4280d4
cmp dword [ebp - 0x14], esi
je 0x42802c
push dword [0x440d04]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x428011
mov eax, dword [0x440d10]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x42808a
cmp dword [0x440d14], edi
je 0x42808a
push eax
call ebx
push dword [0x440d14]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x42808a
test eax, eax
je 0x42808a
call ecx
test eax, eax
je 0x42807f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x42807f
test byte [ebp - 8], 1
jne 0x42808a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4280ba
mov eax, dword [0x440d08]
cmp eax, edi
je 0x4280b7
push eax
call ebx
test eax, eax
je 0x4280b7
call eax
mov esi, eax
test esi, esi
je 0x4280b7
mov eax, dword [0x440d0c]
cmp eax, edi
je 0x4280b7
push eax
call ebx
test eax, eax
je 0x4280b7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x440d04]
call ebx
test eax, eax
je 0x4280d2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4280d4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004181e1
mov esp, ebp
pop ebp
ret
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4016d4
mov edi, esi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
mov edx, edi
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
mov ebx, esi
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
mov esi, eax
mov edx, esi
mov ecx, ebx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40b590
Capabilities:
Enumerate pe sections

Disassembly:
push edi
push esi
push ebx
xor ebp, dword [ecx + 0x1424448b]
wait
xchg edi, eax
jge 0x40b5b1
inc edi
mov ebp, dword [ebx]
mov ss, word [eax]
neg eax
lodsd eax, dword [esi]
fimul dword [ebx - 0x28]
add byte [ecx - 0x76eb5abc], cl
push esp
mov ecx, 0x24448b10
push es
mov eax, dword [esp + 6]
or eax, eax
jge 0x40b5cd
inc edi
mov edx, dword [ebx + eax*2 + 0x18]
neg eax
neg edx
sbb eax, 0
in eax, dx
inc esp
sub bl, byte [eax + eax*4]
pop ebp
and al, 0x6c
or eax, eax
jne 0x40b5e9
mov esp, dword [edx]
and al, 0x18
mov eax, dword [ecx + ecx*8 + 0x14]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword [esp + 0x10]
div ecx
mov ebx, dword [edi - 0x10]
inc ecx
mov ebx, eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
shr ebx, 1
rcr ecx, 1
shr edx, 1
rcr eax, 1
or ebx, ebx
jne 0x40b5f7
div ecx
mov esi, eax
and al, 0x1c
mov ecx, eax
mov eax, dword [esp + 0x18]
div ecx
add edx, ecx
mov fs, word [edx + 0x3b]
push esp
cdq
adc al, 0x77
or cl, dh
pop es
cmp eax, dword [esp + 0x10]
jbe 0x40b626
dec esi
xor edx, edx
mov eax, esi
dec edi
push es
pop es
neg edx
neg eax
jl 0x40b60d
add byte [ebx + 0x5e], bl
pop edi
ret 0x10
Function at 0x41a3c8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x490d40]
jne 0x41a3d2
repz ret
jmp fcn.00422546

Function at 0x4206dc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x490d40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00417a3c
and dword [ebp - 0x14], 0
cmp dword [0x497154], 0
mov dword [ebp - 0x18], eax
jne 0x42078f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x420837
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x483470
push ebx
call edi
test eax, eax
je 0x420837
mov esi, dword [section..data]
push eax
call esi
push 0x483460
push ebx
mov dword [0x497154], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x497158], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x49715c], eax
call edi
push eax
call esi
mov dword [0x497164], eax
test eax, eax
je 0x42078f
push 0x483418
push ebx
call edi
push eax
call esi
mov dword [0x497160], eax
mov eax, dword [0x497160]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x490004]
cmp eax, ecx
je 0x4207e8
cmp dword [0x497164], ecx
je 0x4207e8
push eax
call esi
push dword [0x497164]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4207e8
test ebx, ebx
je 0x4207e8
call edi
test eax, eax
je 0x4207df
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4207df
test byte [ebp - 8], 1
jne 0x4207e8
or dword [ebp + 0x10], 0x200000
jmp 0x42081b
mov eax, dword [0x497158]
cmp eax, dword [ebp - 0x18]
je 0x42081b
push eax
call esi
test eax, eax
je 0x42081b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42081b
mov eax, dword [0x49715c]
cmp eax, dword [ebp - 0x18]
je 0x42081b
push eax
call esi
test eax, eax
je 0x42081b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x497154]
call esi
test eax, eax
je 0x420837
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x420839
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a3c8
leave
ret
Function at 0x46868d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
xor edi, edi
mov byte [ebp + 0xb], 1
cmp dword [ebx + 4], esi
je 0x4687a8
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov byte [eax], 0
mov eax, dword [ebp + 0x10]
mov byte [ecx], 0
mov ecx, dword [ebp + 0xc]
mov byte [edx], 0
mov byte [eax], 0
mov dword [ecx], esi
lea ebx, [ebx]
push esi
push ebx
call fcn.004362b4
movzx eax, word [eax]
cmp eax, 0x2b
je 0x4686f0
cmp eax, 0x5e
je 0x4686eb
cmp eax, 0x21
je 0x4686eb
cmp eax, 0x23
jne 0x468723
cmp eax, 0x2b
jne 0x4686f9
mov edx, dword [ebp + 0x10]
mov byte [edx], 1
inc esi
jmp 0x4686cd
cmp eax, 0x5e
jne 0x468707
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
inc esi
jmp 0x4686cd
cmp eax, 0x21
jne 0x468715
mov ecx, dword [ebp + 0x18]
mov byte [ecx], 1
inc esi
jmp 0x4686cd
cmp eax, 0x23
jne 0x468720
mov edx, dword [ebp + 0x1c]
mov byte [edx], 1
inc esi
jmp 0x4686cd
push esi
inc esi
push ebx
mov dword [ebp + 0x1c], esi
call fcn.004362b4
movzx eax, word [eax]
cmp eax, 0x7b
jne 0x468811
mov eax, 0x40
lea ecx, [ebp - 0x10]
call fcn.004013c0
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp - 0x10]
push ecx
push ebx
push 0x7d
call fcn.0045f9d3
test al, al
je 0x4687ed
mov edx, dword [ebp - 0x10]
mov eax, dword [edi*4 + 0x492968]
push edx
push eax
call fcn.0041164b
add esp, 8
test eax, eax
je 0x46877d
inc edi
cmp edi, 0x62
jl 0x46875f
cmp edi, 0x62
jne 0x4687e4
xor edi, edi
lea esi, [ebp - 0x10]
call fcn.00402150
movzx ecx, word [eax]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanW]
mov edx, dword [ebp + 0xc]
cwde
mov dword [edx], eax
cmp eax, 0xffffffff
jne 0x4687b3
mov ecx, esi
call fcn.00402260
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
test eax, 0x200
je 0x4687c0
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
test eax, 0x400
je 0x4687cd
mov edx, dword [ebp + 0x18]
mov byte [edx], 1
test eax, 0x100
je 0x468807
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
mov byte [eax], 1
call fcn.00402260
jmp 0x46884a
cmp byte [edi + 0x492af0], 0
je 0x4687fb
lea ecx, [ebp - 0x10]
mov byte [ebp + 0xb], 0
call fcn.00402260
jmp 0x46884a
movzx ecx, byte [edi + str._f_b_b..__reepqrstuvwxyz________t___]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
lea ecx, [ebp - 0x10]
call fcn.00402260
jmp 0x46884a
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
mov ecx, dword [ebp + 0xc]
cwde
mov dword [ecx], eax
cmp eax, 0xffffffff
je 0x4687a8
test eax, 0x200
je 0x468830
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
test eax, 0x400
je 0x46883d
mov ecx, dword [ebp + 0x18]
mov byte [ecx], 1
test eax, 0x100
je 0x46884a
mov edx, dword [ebp + 0x10]
mov byte [edx], 1
mov eax, dword [ebp + 0xc]
and dword [eax], 0xff
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18