joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d0900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x7d096c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x7d09b3
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.00825b28
add esp, 8
test eax, eax
jne 0x7d09b1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x7d09b5
jmp 0x7d0963
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x800870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x867147
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x884f3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.007ff760
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.007ff760
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.007ff760
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00800170
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00800170
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00800170
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x800b50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x867237
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x884f3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.007ff680
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.007ff680
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.007ff680
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00800190
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00800190
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00800190
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x8153a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x869e80
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x884f3c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x888d14
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], 0x888df8
call fcn.007ca850
mov byte [esp + 0x38], 1
call fcn.00814574
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.007ca920
mov dword [esi], 0x888e1c
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x8463b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x84643d
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00820fe0
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x846400
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x846422
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x846498
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.00846108
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x846484
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x846498
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x8463c1
pop esi
pop ebx
leave
ret
Function at 0x4132d9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4132fe
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
push 0
push dword [ebp - 0x24]
call fcn.00416a62
pop ecx
pop ecx
jmp 0x413434
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x413336
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push dword [eax]
call fcn.0049499a
pop ecx
jmp 0x413434
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
and dword [ebp - 8], 0
jmp 0x41334f
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2024
jge 0x413434
and dword [ebp - 0xc], 0
jmp 0x413369
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x21c2
jge 0x41342f
and dword [ebp - 0x10], 0
jmp 0x413383
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x74ec
jge 0x41342a
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cdq
idiv ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 1], 0x78
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0x40]
sub ecx, eax
imul ecx, dword [ebp - 0x18]
mov dword [ebp - 0x44], ecx
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0x18]
imul ecx, eax
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 2], 0xd7
mov byte [ebp - 3], 0xd8
movzx eax, byte [ebp - 2]
imul eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x44]
sub ecx, eax
movzx eax, byte [ebp - 3]
imul eax, dword [ebp - 0x1c]
add ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, ecx
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
add ecx, eax
xor ecx, dword [ebp - 0x10]
mov eax, ecx
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push 0x6472
push 0x29b5
push 0x709a
push 1
lea eax, [ebp - 0x50]
push eax
push 0
call fcn.00412242
add esp, 0x18
jmp 0x41337c
jmp 0x413362
jmp 0x413348
mov esp, ebp
pop ebp
ret
Function at 0x415dea
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x415e0c
push 0x3254
push 1
call fcn.00415f38
pop ecx
pop ecx
jmp 0x415f33
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x415f1f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
and dword [ebp - 8], 0
jmp 0x415e63
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x7ac1
jge 0x415f1d
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov dword [ebp - 0x10], eax
mov byte [ebp - 1], 0x8e
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0x40]
sub ecx, eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov byte [ebp - 2], 0xc4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
mov al, byte [ebp - 1]
mov byte [ebp - 3], al
mov byte [ebp - 4], 0x32
movzx eax, byte [ebp - 2]
mov ecx, dword [ebp - 0x44]
sub ecx, eax
imul ecx, dword [ebp - 0x14]
movzx eax, byte [ebp - 2]
mov edx, dword [ebp - 0x14]
imul edx, eax
add ecx, edx
movzx eax, byte [ebp - 4]
mov edx, dword [ebp - 0x48]
sub edx, eax
movzx eax, byte [ebp - 3]
imul edx, eax
movzx eax, byte [ebp - 3]
movzx esi, byte [ebp - 4]
imul eax, esi
add edx, eax
add ecx, edx
mov eax, dword [ebp - 0x18]
sub eax, ecx
mov ecx, dword [ebp - 0x4c]
xor eax, dword [ecx]
or eax, dword [ebp - 8]
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov ecx, 0xaa3b78
call fcn.00423494
jmp 0x415e5c
jmp 0x415f33
push 0
push 0xa9da61
push str._::DeleteMenu__0__5835__1195___error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41f066
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x41f0d5
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41f097
push 0x196c
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x41f0d3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
jmp 0x41f0b0
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x5dce
jge 0x41f0d3
push 0
push 1
push 0x121
push dword [ebp - 0x14]
lea eax, [ebp - 4]
push eax
call fcn.00415734
add esp, 0x14
jmp 0x41f0a9
jmp 0x41f0f6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
push 0x48c2
push dword [ebp - 0x1c]
push 1
call fcn.004131f5
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x41ff29
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x41ff99
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41ff87
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0x1e8b
jge 0x41ff85
push dword [ebp - 0x20]
push 1
push 1
call fcn.0041ee4d
add esp, 0xc
jmp 0x41ff94
push 0
push 0x217d
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x420031
lea eax, [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x420013
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
and dword [ebp - 4], 0
jmp 0x41ffe0
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x194e
jge 0x420011
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [eax]
mov ecx, dword [ecx]
sar eax, cl
and eax, dword [ebp - 4]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push 1
push 0
lea eax, [ebp - 0x50]
push eax
call fcn.0041f631
add esp, 0xc
jmp 0x41ffd9
jmp 0x420031
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
push dword [eax + 4]
push dword [eax]
mov ecx, 0xaa3b78
call fcn.00423494
mov esp, ebp
pop ebp
ret
Function at 0x42e580
Capabilities:
Accept command line arguments
Authenticate hmac
Encode data using base64
Encode data using xor

Disassembly:
fcmovnbe st(0), st(5)
jo 0x42e5f1
or eax, 0xaf435de4
popal
mov gs, word [edi]
xor ecx, dword [eax + 0x7d]
ret 0x69cf
or al, 0xec
lds esp, [ebp - 0x80]
inc edx
in eax, dx
daa
Function at 0x4343f5
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x43b16f
jmp 0x42dba3
jmp 0x4378d6
jmp 0x426023
jmp 0x42ac5f
jmp 0x428ad5
jmp 0x436baf
Function at 0x439891
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
jmp 0x43436d
push eax
push 0xe103
pop eax
add eax, 0xb2375
add eax, 0x95198
xor eax, 0x460c0
add eax, 0x6baf
push 0x7983
pop eax
sub eax, 0x694eb
inc eax
inc eax
inc eax
push 0xeaf4
pop eax
add eax, 0xd8ab2
dec eax
add eax, 0x60d83
shl eax, 0x23
push 0x15090
pop eax
sar eax, 0x7e
xor eax, 0xe9e69
inc eax
sub eax, 0xeeabf
pop eax
jmp 0x431098
jmp 0x43780c
jmp 0x434e2b
jmp 0x436b43
jmp 0x436baa
push eax
push 0x4b88
pop eax
dec eax
shr eax, 0x39
shr eax, 0xd2
shl eax, 0xed
dec eax
shr eax, 0x4a
inc eax
push 0x87df
pop eax
xor eax, 0x4e1f9
sub eax, 0x99c9c
dec eax
sar eax, 0xa0
inc eax
dec eax
inc eax
jmp 0x42ac5a
push eax
push 0x8148
pop eax
shr eax, 0x22
shl eax, 0xfa
push 0x13901
pop eax
inc eax
shl eax, 0x4e
pop eax
jmp 0x427b6f
push eax
push 0x377f
pop eax
inc eax
shr eax, 0x6b
shr eax, 0xd4
push 0x18a
pop eax
inc eax
shl eax, 0xbf
shl eax, 0x99
push 0xe0e7
pop eax
dec eax
shr eax, 0xab
xor eax, 0x40ae9
pop eax
jmp 0x434219
jmp 0x4294af
jmp 0x43bf6c
push eax
push 0xe02c
pop eax
inc eax
pop eax
jmp 0x42d7c4
push eax
push 0x18449
pop eax
dec eax
pop eax
jmp 0x433371
push eax
push 0x14f55
pop eax
inc eax
sub eax, 0x2edb4
sub eax, 0x90baa
shl eax, 0xa2
dec eax
push 0x12aab
pop eax
sar eax, 0xe2
xor eax, 0xf81d
shl eax, 0x54
sub eax, 0x754ca
sub eax, 0x617f8
push 0xcd56
pop eax
sub eax, 0x1e133
add eax, 0x62a1
sar eax, 0x3b
sub eax, 0x2e4d2
add eax, 0x6de1c
push 0x1871
pop eax
sar eax, 0x69
sar eax, 0xdc
sub eax, 0x59577
shr eax, 0x10
sar eax, 0x4d
push 0xa14f
pop eax
sar eax, 0x2f
sub eax, 0x7ed07
sub eax, 0xdd6a9
add eax, 0x2731e
sub eax, 0x87f3a
pop eax
jmp 0x431b2a
push eax
push 0xdfbd
pop eax
dec eax
add eax, 0x63ca4
push 0x4da3
pop eax
add eax, 0x25c41
shr eax, 0xc
pop eax
jmp 0x436a2e
jmp 0x43b576
jmp 0x42fde7
jmp 0x433ade
jmp 0x43b16a
push eax
push 0x16628
pop eax
dec eax
pop eax
jmp 0x42a9e3
push eax
push 0x12068
pop eax
inc eax
sub eax, 0x86f04
sub eax, 0x4bb56
add eax, 0xdc86e
inc eax
sub eax, 0x7f3af
shr eax, 0x1e
push 0x10ab9
pop eax
sar eax, 0x53
dec eax
shl eax, 0xb2
inc eax
shr eax, 0xae
shl eax, 0x3b
xor eax, 0x90d8
push 0xbbd6
pop eax
xor eax, 0xf0aec
add eax, 0xdb393
shr eax, 0x7b
dec eax
shl eax, 0x97
add eax, 0xd123d
dec eax
push 0x16b83
pop eax
dec eax
dec eax
xor eax, 0x43708
add eax, 0x52e81
add eax, 0x15317
inc eax
dec eax
push 0x7b88
pop eax
add eax, 0xdd26d
shl eax, 0x96
sub eax, 0x959fe
sub eax, 0x331a4
sar eax, 0x79
add eax, 0xbde13
inc eax
push 0x12831
pop eax
sar eax, 0x99
xor eax, 0x419f1
inc eax
inc eax
inc eax
shl eax, 0xa1
sub eax, 0x5eda4
push 0x613f
pop eax
shl eax, 0xa8
sub eax, 0x45348
sub eax, 0x8b692
dec eax
inc eax
dec eax
xor eax, 0xc5032
pop eax
jmp 0x42db9e
jmp 0x49509a
jmp 0x42601e
jmp 0x4376fe
jmp 0x428ad0
jmp 0x434459
Function at 0x4430f3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x443170
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x443150
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
add eax, dword [ecx]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x44316e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x44316e
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x443188
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
push 0
push 0x7e21
push dword [ebp - 0x2c]
call fcn.0044a9e6
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x4459cd
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x445a19
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 0x5bdb
push dword [ebp - 0xc]
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0044ac80
add esp, 0x1c
jmp 0x445a55
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x445a4b
push 0
push 0x6ba
push 0x11ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
jmp 0x445a55
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esp, ebp
pop ebp
ret