joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058f4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0xc18], ebx
cmp byte [esi + 0x16], bl
je 0x40590e
mov byte [ebp + 0x10], 1
mov dword [ebp - 4], 0x80000000
cmp byte [ebp + 0x14], bl
je 0x405921
mov dword [ebp - 4], 0xc0000000
mov dword [ebp + 0x14], 1
cmp byte [ebp + 0x10], bl
je 0x405934
mov dword [ebp + 0x14], 3
xor eax, eax
cmp byte [esi + 0x15], bl
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.004068a3
test eax, eax
je 0x40596d
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40596d
cmp word [eax], bx
je 0x40596d
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x405981
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40599d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40599d
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne byte [ebp + 0x13]
mov byte [esi + 0x12], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
cmp byte [ebp + 0x13], bl
je 0x4059ff
mov dword [esi + 4], edi
cmp dword [ebp + 0xc], ebx
je 0x4059cb
push dword [ebp + 0xc]
lea eax, [esi + 0x418]
push eax
call fcn.0040ba0d
jmp 0x4059d4
xor eax, eax
mov word [esi + 0x418], ax
lea eax, [esi + 0x17]
cmp dword [ebp + 8], ebx
je 0x4059e7
push dword [ebp + 8]
push eax
call fcn.0040a7b3
jmp 0x4059f5
push 0x1000000
push eax
push dword [ebp + 0xc]
call fcn.0040b7ea
push dword [esi + 4]
mov ecx, esi
call fcn.0040575a
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x405b2f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 1
mov esi, 0x4e20
jne 0x405b55
cmp dword [ebp + 0xc], esi
jbe 0x405b4a
mov dword [ebp + 0xc], esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405ba5
mov ecx, edi
call fcn.004058ae
test al, al
je 0x405b8b
cmp dword [ebp + 0xc], esi
jbe 0x405b8b
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.00405b2f
jmp 0x405ba8
cmp dword [edi + 0xc], 1
jne 0x405ba0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x405ba0
xor eax, eax
jmp 0x405ba8
or eax, 0xffffffff
jmp 0x405ba8
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x405de2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
je 0x405ee2
mov eax, dword [esi + 0xc]
test eax, eax
je 0x405e0f
dec eax
je 0x405e04
dec eax
jne 0x405e0f
push 0xfffffffffffffff4
jmp 0x405e06
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0xc], edi
je 0x405e5e
cmp dword [ebp + 0xc], edi
jbe 0x405e79
mov ecx, dword [ebp + 0xc]
sub ecx, edi
mov eax, 0x4000
cmp ecx, eax
jae 0x405e36
mov eax, ecx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
je 0x405e79
add edi, 0x4000
cmp edi, dword [ebp + 0xc]
jb 0x405e26
jmp 0x405e75
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
test al, al
jne 0x405edc
cmp byte [esi + 0x14], 0
je 0x405edc
cmp dword [esi + 0xc], 0
jne 0x405edc
push 0
lea eax, [esi + 0x17]
mov edi, 0x414474
push eax
mov ecx, edi
call fcn.004038dd
test al, al
je 0x405ecf
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x405e17
test eax, eax
jbe 0x405e17
push 0
mov ecx, esi
call fcn.0040582f
mov ecx, dword [ebp - 4]
xor edi, edi
sub eax, ecx
sbb edx, edi
push edx
push eax
mov ecx, esi
call fcn.00405d4a
jmp 0x405e17
lea eax, [esi + 0x17]
push eax
push 0
mov ecx, edi
call fcn.00403a65
pop edi
mov byte [esi + 8], 1
pop ebx
pop esi
leave
ret 8

Function at 0x405fc4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
lea eax, [ebp - 0x400]
push eax
push dword [ebp + 8]
call fcn.00407803
movsx eax, byte [ebp - 0x400]
neg eax
sbb eax, eax
lea ecx, [ebp - 0x400]
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x406004
cmp eax, 5
je 0x406004
xor eax, eax
jmp 0x406007
xor eax, eax
inc eax
leave
ret 4

Function at 0x40600b
Capabilities:
Get file attributes

Disassembly:
call fcn.004068a3
test eax, eax
je 0x40602b
mov eax, dword [esp + 8]
test eax, eax
je 0x40602b
cmp word [eax], 0
je 0x40602b
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x406035
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8

Function at 0x40605f
Capabilities:
Get file attributes

Disassembly:
call fcn.004068a3
test eax, eax
je 0x40607f
mov eax, dword [esp + 8]
test eax, eax
je 0x40607f
cmp word [eax], 0
je 0x40607f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x406089
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8
Function at 0x40608c
Capabilities:
Set file attributes

Disassembly:
call fcn.004068a3
test eax, eax
je 0x4060b0
mov eax, dword [esp + 8]
test eax, eax
je 0x4060b0
cmp word [eax], 0
je 0x4060b0
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x4060be
push dword [esp + 0xc]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 0xc

Function at 0x4060f8
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.004068a3
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x40611d
test esi, esi
je 0x40611d
cmp word [esi], 0
je 0x40611d
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x406128
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x406142
cmp byte [ebp + 0x10], 0
je 0x40613e
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
call fcn.0040608c
xor eax, eax
jmp 0x40615a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x406157
cmp eax, 3
je 0x406157
xor eax, eax
inc eax
jmp 0x40615a
push 2
pop eax
pop esi
pop ebp
ret 0x10
Function at 0x407f33
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4ee0
call fcn.00401200
push 1
mov ecx, 0x414474
call fcn.0040385e
call fcn.0040b022
push 0x400
lea eax, [ebp - 0x400]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x8005
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 0x400]
push eax
mov ecx, 0x414480
call fcn.00409b1a
lea ecx, [ebp - 0x4ee0]
call fcn.00402c64
push 0x40f3a0
lea eax, [ebp - 0x1c45]
push eax
call fcn.0040a7b3
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x40801f
cmp byte [eax], 0x22
jne 0x407fb5
push 0x22
inc eax
push eax
call fcn.0040a6e9
test eax, eax
je 0x40801f
push esi
push 0x40f39c
push eax
call fcn.0040a752
mov esi, eax
test esi, esi
je 0x40801e
jmp 0x407fce
inc esi
movsx eax, byte [esi]
push eax
call fcn.0040b11f
test al, al
jne 0x407fcd
movsx eax, byte [esi]
push eax
lea ecx, [ebp - 0x4ee0]
call fcn.0040294e
test al, al
je 0x40801e
movzx eax, byte [esi + 1]
push eax
call fcn.0040b0f4
movzx eax, al
mov ecx, eax
sub ecx, 0x3f
je 0x408013
sub ecx, 0x15
je 0x40800b
dec ecx
dec ecx
jne 0x40801e
mov byte [ebp - 0x1c45], al
jmp 0x40801e
lea ecx, [ebp - 0x4ee0]
call fcn.00402821
pop esi
push 0
lea eax, [ebp - 0x400]
push eax
lea ecx, [ebp - 0x4ee0]
call fcn.00402923
lea ecx, [ebp - 0x4ee0]
call fcn.00402a2d
push dword [ebp - 0x2640]
push dword [ebp - 0x2644]
call fcn.00402ca8
lea eax, [ebp - 0x2a47]
push eax
call fcn.00402c97
cmp byte [ebp - 0x25f8], 0
jne 0x408071
cmp dword [ebp - 0x2644], 3
je 0x408071
xor al, al
jmp 0x408073
mov al, 1
mov byte [0x41447d], al
mov al, byte [ebp - 0x205e]
lea ecx, [ebp - 0x4ee0]
mov byte [0x41447e], al
call fcn.004027c7
lea ecx, [ebp - 0x4ee0]
call fcn.004028a3
lea ecx, [ebp - 0x4ee0]
call fcn.00402b94
call fcn.00405ccf
mov eax, dword [0x414474]
leave
ret
Function at 0x409cae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x20
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 8], ecx
call fcn.0040a5c2
xor eax, eax
push 4
xor ecx, ecx
mov dword [ebp + 8], eax
xor ebx, ebx
pop edx
cmp eax, 0xa
jg 0x409dbc
cmp ebx, edx
jge 0x409d03
lea esi, [ebp + ebx*4 - 0x28]
mov dword [ebp - 4], esi
cmp ecx, edx
jge 0x409d05
mov edi, dword [ebp - 8]
lea esi, [ecx + eax*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, dword [ebp - 4]
add dword [ebp - 4], edx
inc ebx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x409ce8
cmp ecx, edx
jne 0x409d0d
inc eax
mov dword [ebp + 8], eax
xor ecx, ecx
cmp ebx, edx
jl 0x409cd4
cmp eax, 0xa
jg 0x409dbc
mov dword [ebp - 4], 0x4184a0
movzx esi, byte [ebp - 0x1b]
mov al, byte [ebp - 0x28]
xor al, byte [esi + 0x4185c0]
movzx esi, byte [ebp - 0x1a]
mov bl, byte [esi + 0x4185c0]
movzx esi, byte [ebp - 0x19]
xor byte [ebp - 0x27], bl
mov bl, byte [esi + 0x4185c0]
movzx esi, byte [ebp - 0x1c]
xor byte [ebp - 0x26], bl
mov bl, byte [esi + 0x4185c0]
mov esi, dword [ebp - 4]
xor al, byte [esi]
xor byte [ebp - 0x25], bl
inc dword [ebp - 4]
push 3
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x24]
pop edi
xor esi, esi
mov bl, byte [eax + esi - 4]
xor byte [eax + esi], bl
inc esi
cmp esi, edx
jl 0x409d68
add eax, edx
dec edi
jne 0x409d66
xor ebx, ebx
cmp dword [ebp + 8], 0xa
jg 0x409dbc
cmp ebx, edx
jge 0x409da5
lea eax, [ebp + ebx*4 - 0x28]
cmp ecx, edx
jge 0x409da7
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
lea esi, [ecx + esi*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, eax
inc ebx
add eax, edx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x409d89
cmp ecx, edx
jne 0x409dae
inc dword [ebp + 8]
xor ecx, ecx
cmp ebx, edx
jl 0x409d7b
cmp dword [ebp + 8], 0xa
jle 0x409d21
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x409dc3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
add ecx, 0x24
push 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 9
pop edi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 8], edi
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x4154a0]
xor dl, byte [eax + ebx*4 + 0x415ca0]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x4160a0]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x4158a0]
add ecx, edi
mov byte [esi], dl
add esi, edi
dec dword [ebp - 8]
jne 0x409deb
inc eax
cmp eax, edi
jl 0x409dde
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0040a5c2
add dword [ebp - 4], 0x10
dec dword [ebp - 0xc]
jne 0x409ddc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ae2c
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4
Function at 0x403230
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
mov dword [0x8741ecb2], eax
dec edx
push 0x7f
sti
in eax, 0x4b
sub ch, cl
fist dword [esi + 0x3fc6d01e]
dec edx
cmpsd dword [esi], dword es:[edi]
popfd
dec edx
and dword [eax - 0x5c6e4459], esi
clc
pop ss
xlatb
push es
xchg esi, eax
dec edx
invalid

Function at 0x4057a0
Capabilities:
Encode data using xor

Disassembly:
xchg byte [ecx - 0x52], dl
inc esi
mov eax, 0x9751667a
test dword [ebx - 0x28], ebp
cmp eax, ebp
jno 0x405755
pop esi
mov edx, 0xf9a11e32
dec esi
pop edi
cmpsb byte [esi], byte es:[edi]
sub dword [edi], edx
xor esi, dword [esp + edx*4]
mov eax, 0xda14b2c7
jbe 0x405736
mov dl, 0x14
fidiv dword [esi - 0xf]
jnp 0x405720
ljmp 0x8f09:0x8c6974a6
or dword [ecx], ecx
pop esi
stosb byte es:[edi], al
test byte [ebx], bl
ljmp 0x9f0e
int3
loop 0x405814
lahf
scasd eax, dword es:[edi]
push cs
sahf
push es
xor ch, dh
aad 0x90
dec ebp
test dword [esi - 0x1b], edx
movsb byte es:[edi], byte [esi]
jb 0x405786
movsb byte es:[edi], byte [esi]
mov byte gs:[0x92965bbc], al
push edx
lds esi, [edi]
cmc
jnp 0x405740
in al, dx
jecxz 0x4057f9
int1
mov dword [0x6213ffa5], eax
pop esi
pushfd
fcmove st(0), st(4)
mov dl, 0x74
mov dl, 0xc5
insb byte es:[edi], dx
mov ebp, 0xa39e6683
mov edx, 0x6e1dea3c
cdq
ret
aaa
mov ch, 0xfb
invalid
cmpsb byte [esi], byte es:[edi]
xchg esp, eax
sbb dword [eax], eax
pop ss
sub al, 0xc7
jg 0x40587b
mov edx, 0x1211f9cb
aaa
add ebp, 0xfffffff3
sub al, 3
in al, 0xcc
insb byte es:[edi], dx
mov dl, 0x4f
test al, 0xe9
mov edx, 0xd8a13fe5
sti
or byte [esi - 0x3603f8a7], ch
in eax, 0x3f
mov eax, dword [0xae08fbd8]
pop ecx
pop es
cld
leave
jle 0x4057ea
mov dl, 0xf
dec esi
mov dword [0xfed28e3d], eax
jb 0x4057c0
not dword [edi + 0xf]
das
mov esi, 0xa533b179
pop esp
inc esp
adc byte [edx], ah
xor bl, byte [edi + ebx - 0x5c850ad0]
mov dword [edx - 0x29], ecx
div ah
jae 0x4057f7
enter 0xffffffffffffc945, 0x50
adc eax, dword [ebx + 0x62004450]
push ebx
push eax
inc esp
add byte [edx + 0x53], ah
pop edi
in al, 0xe6
daa
pop ebx
or ebp, dword [ecx]
and ecx, 0xd6a7b90e
and al, 0x83
and eax, 0x7b10d01d
sub al, 0xd1
xor eax, 0x6b12601f
popal
push eax
retf
push ebx
mov ah, byte [ecx + 0x965f90a]
nop
stosb byte es:[edi], al
salc
add byte [esi + 0x24], 0x8a
mov ebx, 0xa1a017d7
jl 0x4058b1
pop ss
mov al, byte [0xbc217ca1]
retf 0xd3ed
mov esp, 0xc6d3edca
xor edx, edi
nop
xor eax, ebp
mov ecx, 0x909953ec
xchg esp, eax
in eax, dx
jg 0x40588b
jecxz 0x405859
dec ebp
dec ebp
sal dl, 0xd4
wait
mov bl, byte ds:[edx + 0x263b91ac]
xor al, 0xfc
xor al, 0xfc
pop ss
dec esp
loop 0x40584d
in eax, dx
fcmovu st(0), st(3)
ret

Function at 0x432c5c
Capabilities:
Encode data using xor

Disassembly:
xor bh, ah
lahf
std
lahf
dec esp
sub ebp, esp
fsub st(5), st(0)
in eax, dx
ja 0x432cde
loope 0x432c67
add dword [edx], 0x3b
loope 0x432c74
lds sp, [ebx + 0x60]
pushal
sti
test byte [ebp + ecx*8 + 0x6239809f], dl
lds edx, [esi + eax - 0x3b054f73]
push esi
inc esp
daa
xchg ecx, eax
invalid
js 0x432d20
mul ebp
retf 0x26a6
pop edi
jmp 0xe47e3f4

Function at 0x448cec
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x11508e61
sub byte [edx - 0x46], dl
invalid
Function at 0x4498cc
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov dword [0xcabb07ad], eax
imul edi, dword [edx*4 + 0x13546db8], 0xa7fae1a3
pop es
mov ebx, 0x953c69ca
mov eax, 0xa313546d
loope 0x4498d5
insd dword es:[edi], dx
push esp
adc esp, dword [ebx - 0x7d58051f]
xchg dword [esi], ebp
push ebp
add dh, dl
cmp dword [eax], ebp
inc ebx
push es
cmpsd dword [esi], dword es:[edi]
add byte [edi - 0x29ffaad2], 0x39
sub byte [ebx + 6], al
mov ebx, 0x61a9783f
jno 0x4498d7
xor bl, byte [edx + ebp*8 - 0xd92059e]
sbb al, 0x44
lodsb al, byte [esi]
xor edx, dword [ecx + 0x7d767a9e]
inc esi
ja 0x4498ce
dec eax
fdiv qword [edi]
pop esi
ljmp 0xcb2c

Function at 0x44ea48
Capabilities:
Encode data using xor

Disassembly:
jno 0x44eab8
dec esi
xchg edi, eax
pop ebp
daa
sub edx, dword [eax - 0x35]
outsb dx, byte [esi]
aam 0x35
das
inc edx
int 0xdb
test eax, 0x136c36fa
xchg esp, eax
movsd dword es:[edi], dword [esi]
Function at 0x45f68c
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
not dword [ebx]
adc al, 0x9e
add dh, bl
pop esp
adc eax, 0x39c9b8d1
nop
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x72]
sal dword [esp], 0x82
adc ax, 0x56bb
invalid

Function at 0x4603c4
Capabilities:
Execute syscall

Disassembly:
pop ebx
sub dword [ebx], esp
jp 0x46043e
or byte [0xf5d79f04], ch
adc ch, byte [edi + 0x820cf4a]
stosd dword es:[edi], eax
sbb al, 0xe1
mov cl, 0x77
salc
dec esp
invalid
pop ecx
sbb al, 0xbf
invalid
Function at 0x401e80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x401f60
mov eax, dword [esi + 0x188bc]
test eax, eax
je 0x401f60
cmp eax, 6
je 0x401f60
cmp dword [esi], 0
jne 0x401ebc
lea edx, [esi + 0x1ab7c]
lea ecx, [esi + 0x1aa7c]
call fcn.00404b30
mov dword [esi], eax
mov word [esi + 0x1a882], 0
xor edi, edi
nop word [eax + eax]
mov ecx, dword [esi]
test ecx, ecx
je 0x401f60
cmp byte [ecx], 0
je 0x401f1e
push 0
push 0x186a0
lea ebx, [esi + 0xc]
push ebx
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
js 0x401f60
jle 0x401f60
cmp dword [esi + 0x188bc], 0
je 0x401f14
cmp edi, 0x10
jge 0x401f14
push eax
mov edx, ebx
mov ecx, esi
call fcn.004018d0
add esp, 4
inc edi
cmp edi, 0x64
jl 0x401ed0
pop edi
pop esi
pop ebx
ret
cmp byte [ecx + 1], 0
je 0x401f60
mov eax, dword [ecx + 0x44c]
test eax, eax
jle 0x401f35
dec eax
mov dword [ecx + 0x44c], eax
cmp dword [ecx + 0x44c], 0
jg 0x401f60
push 0
push 0
push ecx
push 0x4049e0
push 0
push 0
mov dword [ecx + 0x44c], 0xf0
mov byte [ecx + 1], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
ret

Function at 0x401e81
Capabilities:
Create thread
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x401f60
mov eax, dword [esi + 0x188bc]
test eax, eax
je 0x401f60
cmp eax, 6
je 0x401f60
cmp dword [esi], 0
jne 0x401ebc
lea edx, [esi + 0x1ab7c]
lea ecx, [esi + 0x1aa7c]
call fcn.00404b30
mov dword [esi], eax
mov word [esi + 0x1a882], 0
xor edi, edi
nop word [eax + eax]
mov ecx, dword [esi]
test ecx, ecx
je 0x401f60
cmp byte [ecx], 0
je 0x401f1e
push 0
push 0x186a0
lea ebx, [esi + 0xc]
push ebx
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
js 0x401f60
jle 0x401f60
cmp dword [esi + 0x188bc], 0
je 0x401f14
cmp edi, 0x10
jge 0x401f14
push eax
mov edx, ebx
mov ecx, esi
call fcn.004018d0
add esp, 4
inc edi
cmp edi, 0x64
jl 0x401ed0
pop edi
pop esi
pop ebx
ret
cmp byte [ecx + 1], 0
je 0x401f60
mov eax, dword [ecx + 0x44c]
test eax, eax
jle 0x401f35
dec eax
mov dword [ecx + 0x44c], eax
cmp dword [ecx + 0x44c], 0
jg 0x401f60
push 0
push 0
push ecx
push 0x4049e0
push 0
push 0
mov dword [ecx + 0x44c], 0xf0
mov byte [ecx + 1], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
ret
Function at 0x4033b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x545004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x924], 0
jne 0x4033ed
mov word [edi + 0x400], 0
mov byte [edi + 0x402], 0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00521bd2
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0xc]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [ebp - 0xc]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
cvtdq2ps xmm0, xmm0
push 1
movss dword [edi + 0x3f8], xmm0
movd xmm0, dword [ebp - 8]
cvtdq2ps xmm0, xmm0
movss dword [edi + 0x3fc], xmm0
call esi
shr eax, 0xf
and al, 1
push 2
mov byte [edi + 0x400], al
call esi
shr eax, 0xf
and al, 1
push 5
mov byte [edi + 0x401], al
call esi
movd xmm0, dword [edi + 0x8f4]
xorps xmm2, xmm2
movss xmm1, dword [edi + 0x904]
cvtdq2ps xmm0, xmm0
shr eax, 0xf
and al, 1
mov byte [edi + 0x402], al
divss xmm1, xmm0
comiss xmm1, xmm2
jbe 0x403491
movss xmm0, dword [edi + 0x3f8]
subss xmm0, dword [edi + 0x8fc]
divss xmm0, xmm1
movss dword [edi + 0x3f8], xmm0
movd xmm0, dword [edi + 0x8f8]
movss xmm1, dword [edi + 0x908]
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm2
jbe 0x4034c9
movss xmm0, dword [edi + 0x3fc]
subss xmm0, dword [edi + 0x900]
divss xmm0, xmm1
movss dword [edi + 0x3fc], xmm0
cmp byte [edi + 0x413], 0
je 0x4034f6
mov eax, dword [edi + 0x408]
mov dword [edi + 0x3f8], eax
mov eax, dword [edi + 0x40c]
mov dword [edi + 0x3fc], eax
mov al, byte [edi + 0x410]
mov byte [edi + 0x400], al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00521bd2
mov esp, ebp
pop ebp
ret
Function at 0x403c10
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
push 0x1e0
push 0
mov dword [ebp - 4], ebx
lea edi, [ebx + 0x14]
push edi
call fcn.00522b50
add esp, 0xc
cmp byte [ebx + 0x924], 0
je 0x403d33
mov edx, dword [0x563644]
xor esi, esi
test edx, edx
je 0x403c6e
mov ebx, 0x563648
nop dword [eax]
xor ecx, ecx
cmp esi, 0x14
cmovl ecx, ebx
call fcn.00404d90
mov edx, dword [0x563644]
inc esi
add ebx, 0x48
cmp esi, edx
jb 0x403c50
mov ebx, dword [ebp - 4]
mov eax, 8
cmp edx, eax
cmova edx, eax
xor esi, esi
mov dword [ebx + 0x1f4], edx
test edx, edx
je 0x403d33
mov ebx, 0x563648
nop dword [eax]
xor ecx, ecx
lea edi, [edi + 0x3c]
cmp esi, 0x14
cmovl ecx, ebx
lea eax, [ecx + 8]
neg ecx
sbb ecx, ecx
inc esi
and ecx, eax
add ebx, 0x48
movzx eax, byte [ecx + 2]
mov byte [edi - 0x3b], al
movzx eax, byte [ecx]
mov byte [edi - 0x3c], al
movzx eax, byte [ecx + 4]
mov byte [edi - 0x3a], al
movzx eax, byte [ecx + 6]
mov byte [edi - 0x39], al
movzx eax, byte [ecx + 8]
mov byte [edi - 0x38], al
movzx eax, byte [ecx + 0xc]
mov byte [edi - 0x36], al
movzx eax, byte [ecx + 0xa]
mov byte [edi - 0x37], al
movzx eax, byte [ecx + 0xe]
mov byte [edi - 0x35], al
movzx eax, byte [ecx + 0x10]
mov byte [edi - 0x34], al
movzx eax, byte [ecx + 0x12]
mov byte [edi - 0x33], al
movzx eax, byte [ecx + 0x14]
mov byte [edi - 0x32], al
movzx eax, byte [ecx + 0x16]
mov byte [edi - 0x31], al
mov eax, dword [ecx + 0x18]
mov dword [edi - 0x30], eax
mov eax, dword [ecx + 0x1c]
mov dword [edi - 0x2c], eax
mov eax, dword [ecx + 0x20]
mov dword [edi - 0x28], eax
mov eax, dword [ecx + 0x24]
mov dword [edi - 0x24], eax
mov eax, dword [ecx + 0x28]
mov dword [edi - 0x20], eax
mov eax, dword [ecx + 0x2c]
mov dword [edi - 0x1c], eax
mov eax, dword [ecx + 0x30]
mov dword [edi - 0x14], eax
mov eax, dword [ecx + 0x34]
mov dword [edi - 0x18], eax
cmp esi, edx
jb 0x403c90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret