joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61b5c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.0050fa10
mov eax, dword [0x6b9538]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [esp + 0xbc]
xor ebp, ebp
mov dword [esp + 0x2c], eax
push edi
mov eax, dword [esi + 8]
mov dword [esp + 0x10], eax
sub eax, ebx
mov dword [esp + 0x24], eax
cmp dword [esi + 0xc], ebx
jae 0x61b620
push 0x4d4
push 0x6a16b4
push str.assertion_failed:_rec__orig_len___md_size
call fcn.0056bec0
add esp, 0xc
cmp ebx, 0x40
jbe 0x61b63c
push 0x4d5
push 0x6a16b4
push str.assertion_failed:_md_size___EVP_MAX_MD_SIZE
call fcn.0056bec0
add esp, 0xc
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x34]
neg eax
mov dword [esp + 0x20], ecx
and eax, 0x3f
lea edi, [esp + 0x34]
add edi, eax
lea eax, [ebx + 0x100]
mov dword [esp + 0x2c], edi
cmp ecx, eax
jbe 0x61b66a
mov ebp, ecx
sub ebp, ebx
sub ebp, 0x100
push ebx
xor esi, esi
mov dword [esp + 0x18], 0
push esi
push edi
call fcn.005281f0
add esp, 0xc
mov dword [esp + 0x18], esi
cmp ebp, dword [esp + 0x20]
jae 0x61b71d
mov eax, dword [esp + 0xc0]
mov ecx, ebp
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x28], eax
mov eax, ebp
mov edx, ecx
xor eax, dword [esp + 0x24]
xor edx, dword [esp + 0x10]
lea edi, [eax - 1]
not eax
shr eax, 0x1f
shr edi, 0x1f
and edi, eax
mov eax, ebp
xor eax, dword [esp + 0x10]
neg edi
or edx, eax
mov eax, dword [esp + 0x28]
xor edx, ebp
shr edx, 0x1f
neg edx
mov cl, byte [eax + ebp]
mov eax, edi
or eax, dword [esp + 0x14]
inc ebp
and eax, edx
mov edx, dword [esp + 0x18]
and edi, edx
mov dword [esp + 0x14], eax
and al, cl
or esi, edi
mov edi, dword [esp + 0x2c]
or byte [edx + edi], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, ebx
xor eax, ebx
xor ecx, ebx
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
cmp ebp, dword [esp + 0x20]
jb 0x61b6a5
xor edx, edx
test ebx, ebx
je 0x61b751
mov ebp, dword [esp + 0x30]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + edi]
movzx eax, byte [esi + edi]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, ebx
mov eax, esi
xor ecx, ebx
xor eax, ebx
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, ebx
jb 0x61b727
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0050ea72
add esp, 0xa8
ret
Function at 0x61c290
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.0050fa10
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov eax, dword [ebx + 4]
mov edi, dword [esp + 0x28]
inc edi
mov eax, dword [eax + 0x64]
test byte [eax + 0x34], 1
je 0x61c2dd
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 8]
lea eax, [edi + ecx]
cmp eax, edx
jbe 0x61c2cd
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
add dword [esi + 0x14], ecx
sub edx, ecx
add dword [esi + 0x18], ecx
sub dword [esi + 0xc], ecx
mov dword [esi + 8], edx
jmp 0x61c2e2
cmp edi, dword [esi + 8]
ja 0x61c2c4
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 8]
push ebp
push dword [ebx + 0xb0]
mov al, byte [ecx + eax - 1]
movzx ebp, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebp
call fcn.00559310
push eax
call fcn.00555840
add esp, 8
test eax, 0x200000
je 0x61c328
or eax, 0xffffffff
sub eax, ebp
add dword [esi + 8], eax
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov edx, dword [esi + 8]
lea ecx, [edi + ebp]
mov ebx, edx
mov dword [esp + 0x10], edx
sub ebx, ecx
mov eax, edx
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, edx
shr ebx, 0x1f
dec ebx
cmp edx, eax
cmovb eax, edx
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x61c3b4
mov eax, dword [esi + 0x14]
mov esi, dword [esp + 0x20]
mov edx, esi
mov ebp, dword [esp + 0x10]
shr edx, 0x1f
dec ebp
mov dword [esp + 0x18], edx
add ebp, eax
nop
mov ecx, esi
lea ebp, [ebp - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x2c]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [ebp + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x18]
cmp edi, dword [esp + 0x14]
jb 0x61c370
mov esi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
not ebx
movzx eax, bl
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [ebp + 1]
neg ecx
and eax, ecx
sub edx, eax
mov eax, ecx
pop ebp
pop edi
mov dword [esi + 8], edx
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebx
add esp, 0xc
ret
Function at 0x620ec0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
cmp dword [eax], 5
je 0x620edb
push eax
push esi
call fcn.00621500
add esp, 8
test eax, eax
jle 0x620f23
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push esi
mov edi, eax
call fcn.005555f0
add esp, 8
test edi, edi
jg 0x620f20
push edi
call fcn.0059d850
add esp, 4
test eax, eax
je 0x620f20
push 0xa
push esi
call fcn.00555d50
add esp, 8
mov eax, edi
pop edi
pop esi
ret
Function at 0x10004377
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10004386
pop dword [ebp - 0x20]
mov eax, 0xd70f95eb
add eax, 0x38f0ad9b
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x4ffd1c1
sub dword [ebp - 0x30], 0xb6ad8c76
mov dword [ebp - 0x2c], 0xd692de5a
add dword [ebp - 0x2c], 0x5ba06deb
mov dword [ebp - 0x28], 0xe9b2ad4a
add dword [ebp - 0x28], 0x629996e4
mov dword [ebp - 0x24], 0xfdc75ec2
add dword [ebp - 0x24], 0x238a13e
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xab907e98
add dword [ebp - 0x30], 0xc8e1eabe
mov dword [ebp - 0x2c], 0x35956b44
add dword [ebp - 0x2c], 0xbd6f631
mov dword [ebp - 0x28], 0xca8e4b8e
sub dword [ebp - 0x28], 0x671edf22
mov dword [ebp - 0x24], 0xd8967323
add dword [ebp - 0x24], 0x27698cdd
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xeed7e7b6
add eax, 0x212868c6
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x38af0
push 0
call eax
mov ecx, 0x74d659be
add ecx, 0x8b29f6cc
xor edi, edi
add edi, eax
mov edx, 0x1000a800
add edx, dword [ebp - 0x20]
mov esi, 0x391ce8d
sub dword [ebp - 0x1c], 0x1cde96c8
mov ebx, dword [edx]
add dword [ebp - 0xc], 0xa93f066f
sub ebx, esi
xor dword [ebp - 0x18], esi
mov dword [edi], ebx
xor dword [ebp - 0xc], esi
add edi, 0xc6e620d9
add edi, 0x3919df2b
add edx, 0x84dbc162
add edx, 0x7b243ea2
loop 0x10004499
add eax, 0x30d3a04e
sub eax, 0x30d26b53
xor ebx, ebx
add ebx, eax
add eax, 0x4c50c32e
add eax, 0xb3af3cd7
mov ecx, 0x15d96adb
add ecx, 0xfa269525
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], 0x24785e21
mov ecx, 0x3d090c
mov dword [ebp - 0x2c], 0x534c3239
push ebx
mov dword [ebp - 0x28], 0x33266c75
mov dword [ebp - 0x24], 0x794c4248
mov dword [ebp - 0x20], 0x5f4868
mov dword [ebp - 0x64], 0x65006b
mov dword [ebp - 0x60], 0x6e0072
jb 0x401062
outsb dx, byte [esi]
add bh, al
inc ebp
movsb byte es:[edi], byte [esi]
add byte gs:[eax + eax - 0x39], ch
inc ebp
test al, 0x33
add byte [edx], dh
add bh, al
inc ebp
lodsb al, byte [esi]
add byte cs:[eax + eax - 0x39], ah
inc ebp
mov al, 0x6c
add byte [eax + eax + 0x66], ch
mov dword [ebp - 0x4c], eax

Function at 0x401040
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], 0x24785e21
mov ecx, 0x3d090c
mov dword [ebp - 0x2c], 0x534c3239
push ebx
mov dword [ebp - 0x28], 0x33266c75
mov dword [ebp - 0x24], 0x794c4248
mov dword [ebp - 0x20], 0x5f4868
mov dword [ebp - 0x64], 0x65006b
mov dword [ebp - 0x60], 0x6e0072
jb 0x401062
outsb dx, byte [esi]
add bh, al
inc ebp
movsb byte es:[edi], byte [esi]
add byte gs:[eax + eax - 0x39], ch
inc ebp
test al, 0x33
add byte [edx], dh
add bh, al
inc ebp
lodsb al, byte [esi]
add byte cs:[eax + eax - 0x39], ah
inc ebp
mov al, 0x6c
add byte [eax + eax + 0x66], ch
mov dword [ebp - 0x4c], eax

Function at 0x401540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
xor esi, esi
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov edx, dword [eax + 0x1c]
mov ecx, dword [eax + 0x20]
add edx, edi
mov ebx, dword [eax + 0x18]
add ecx, edi
mov dword [ebp - 0x10], edx
mov edx, dword [eax + 0x24]
add edx, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
test ebx, ebx
je 0x4015a6
mov edx, dword [ecx + esi*4]
xor eax, eax
mov cl, byte [edx + edi]
add edx, edi
test cl, cl
je 0x401599
movzx ecx, cl
lea edx, [edx + 1]
or ecx, 0x60
add eax, ecx
mov cl, byte [edx]
add eax, eax
test cl, cl
jne 0x401586
cmp eax, dword [ebp - 4]
je 0x4015af
mov ecx, dword [ebp - 8]
inc esi
cmp esi, ebx
jb 0x401578
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4037b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x4037cb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x403804
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x403800
jmp 0x4037f0
cmp esi, eax
jae 0x403804
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4037f0
cmp esi, eax
jb 0x40380b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406260
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
mov esi, eax
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
lea ecx, [ebp - 4]
push ecx
push 0
or edx, 0x20006
push edx
push 0
push 0
push 0
push eax
mov eax, dword [esi]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4062c6
mov ecx, dword [ebp + 8]
mov esi, dword [esi + 8]
mov edx, dword [ebp - 4]
push 4
push ecx
push 4
push eax
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 4]
neg esi
sbb esi, esi
push eax
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4062d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae13b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4dbe18]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
push eax
mov dword [esi], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00406650
add eax, 0x10
mov dword [esi + 4], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
push eax
call fcn.00406650
add eax, 0x10
add esp, 8
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
cmp eax, 5
jne 0x406340
xor edi, edi
jmp 0x406350
neg edi
sbb edi, edi
and edi, 0xffffff00
add edi, 0x200
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov dword [esi + 0xc], edi
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406376
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40639c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4063c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
lea ecx, [ebp - 4]
push ecx
or edx, 1
push edx
push 0
push eax
mov eax, dword [esi]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406420
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, dword [esi + 8]
push ecx
mov ecx, dword [ebp - 4]
push edx
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b060
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
push ebx
push esi
push edi
push 0x4bd8ac
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
je 0x40b0ec
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x40b0ec
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x40b0ec
test ebx, ebx
jbe 0x40b0ec
mov ecx, dword [ebp + 0xc]
push 0x4bd8a4
push ecx
lea edx, [ebp + 8]
push edx
mov dword [ebp + 8], 0
call fcn.0048cacd
mov eax, dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x40b0ec
push eax
push 1
push ebx
push esi
call fcn.0048cc82
mov eax, dword [ebp + 8]
push eax
call fcn.0048cd7b
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x40db60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4dbe18]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4dd7b8]
test eax, eax
jl 0x40db93
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret
xor eax, eax
push esi
push 0x11c
push eax
lea edx, [ebp - 0x120]
push edx
mov dword [0x4dd7b8], 0
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
call fcn.0048f0a0
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExW]
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call esi
test eax, eax
jne 0x40dc1f
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x114
call esi
test eax, eax
je 0x40dc6e
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x40dc6e
lea edx, [ebp - 0x144]
push edx
call eax
mov eax, dword [ebp - 0x144]
cmp ax, 9
je 0x40dc55
cmp ax, 6
jne 0x40dc6e
mov eax, 1
mov dword [0x4dd7b8], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
pop esi
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret
Function at 0x412750
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
test eax, eax
jne 0x41276b
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
jne 0x412785
mov eax, 1
mov esp, ebp
pop ebp
ret
push ebx
push edi
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov ebx, eax
cmp edi, ebx
je 0x41285a
push 1
push edi
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x4127da
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push edi
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp - 4]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
push edx
call fcn.00412700
add esp, 4
test eax, eax
je 0x412840
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x412820
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
test eax, eax
je 0x412827
push esi
call dword [sym.imp.USER32.dll_SetFocus]
call dword [sym.imp.KERNEL32.DLL_FreeConsole]
push 0
push edi
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp - 4]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_FreeConsole]
push 0
push edi
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp - 4]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push edi
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp - 4]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 4]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412870
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4dbe18]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xff
lea eax, [ebp - 0x103]
push 0
push eax
mov edi, ecx
mov byte [ebp - 0x104], 0
call fcn.0048f0a0
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
xor esi, esi
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
test eax, eax
je 0x4128d4
test byte [ebp - 0xf2], 0x80
jne 0x4128d4
push esi
push 1
push esi
push 0x12
call ebx
mov esi, 1
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, eax
test esi, esi
je 0x4128eb
push 0
push 3
push 0
push 0x12
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret

Function at 0x412900
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, eax
call fcn.00412750
test eax, eax
jne 0x412914
mov ecx, esi
pop esi
jmp fcn.00412870
pop esi
ret
Function at 0x412c20
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b2348
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x4dbe18]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push eax
mov esi, str.UserExperience
mov dword [esp + 0x14], 1
lea ebx, [esp + 0x14]
call fcn.00403c50
push ecx
mov dword [esp + 0x40], 0
mov ecx, esp
mov dword [esp + 0x1c], esp
push ecx
mov esi, str.SOFTWARE360TotalSecurityExperience
call fcn.00403c50
lea edx, [esp + 0x24]
push edx
xor ecx, ecx
mov dword [esp + 0x44], 0xffffffff
call fcn.004062d0
push eax
mov esi, ebx
call fcn.00406430
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412cc2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412ce2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, 1
cmp dword [esp + 0xc], ebx
je 0x412d03
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [edi + 0x4c]
push esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov byte [esp + 0x18], bl
mov dword [esp + 0x38], ebx
mov edx, dword [0x4e3954]
mov eax, dword [edx + 0xc]
mov ecx, 0x4e3954
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
mov edx, dword [ebp + 8]
mov byte [esp + 0x38], 2
test edx, edx
jne 0x412d40
xor eax, eax
jmp 0x412d54
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412d45
sub eax, ebx
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.00403b30
lea ecx, [esp + 0xc]
push ecx
lea eax, [edi + 0x2c]
call fcn.00413f40
mov byte [esp + 0x38], 1
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412d91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push esi
call ebx
cmp dword [edi + 4], 0
mov dword [edi + 0x10], 0
jne 0x412dd3
lea esi, [edi + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [edi + 4], 0
jne 0x412dd0
push 0
push 0
push edi
push 0x4143a0
push 0
push 0
call fcn.0048d484
add esp, 0x18
mov dword [edi + 4], eax
push esi
call ebx
mov esi, dword [sym.imp.KERNEL32.DLL_SetEvent]
mov dword [edi + 0x10], 0
cmp byte [edi + 8], 0
je 0x412df4
mov eax, dword [edi + 0xc]
test eax, eax
je 0x412df0
push eax
call esi
mov byte [edi + 8], 0
mov dword [edi + 0x10], 0
cmp byte [edi + 8], 0
je 0x412e0f
mov eax, dword [edi + 0xc]
test eax, eax
je 0x412e0b
push eax
call esi
mov byte [edi + 8], 0
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x414f80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x568
mov eax, dword [0x4dbe18]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x11c
lea eax, [ebp - 0x530]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x534], esi
call fcn.0048f0a0
push 0x11c
push 0
push ebx
mov dword [ebp - 0x530], 0x11c
call fcn.0048f0a0
add esp, 0x18
push ebx
mov dword [ebx], 0x11c
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
cmp dword [ebx + 4], 5
jne 0x415000
call fcn.00414e80
test eax, eax
je 0x415000
mov dword [esi + 4], 0
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret
push str.RtlGetVersion
push str.ntdll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x415024
lea ecx, [ebp - 0x530]
push ecx
call eax
mov eax, dword [ebx + 4]
lea edx, [eax + eax*4]
mov eax, dword [ebx + 8]
push edi
lea edi, [eax + edx*2]
mov eax, dword [ebp - 0x52c]
mov edx, dword [ebp - 0x528]
lea ecx, [eax + eax*4]
lea eax, [edx + ecx*2]
cmp eax, edi
jle 0x415058
mov ecx, 0x47
lea esi, [ebp - 0x530]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, eax
xor eax, eax
push 0x40e
push eax
lea ecx, [ebp - 0x412]
push ecx
mov word [ebp - 0x414], ax
call fcn.0048f0a0
add esp, 0xc
lea esi, [ebp - 0x414]
call fcn.00414ed0
test eax, eax
jl 0x4150df
lea edx, [ebp - 0x568]
push edx
mov eax, esi
call fcn.00415110
test eax, eax
je 0x4150df
mov ecx, dword [ebp - 0x558]
mov eax, ecx
shr eax, 0x10
movzx ecx, cx
lea edx, [eax + eax*4]
lea edx, [ecx + edx*2]
cmp edi, edx
jge 0x4150d0
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x554]
mov dword [ebx + 8], ecx
mov ecx, dword [ebp - 0x534]
shr eax, 0x10
mov dword [ebx + 0xc], eax
mov dword [ecx + 4], 1
jmp 0x4150ec
mov edx, dword [ebp - 0x534]
mov dword [edx + 4], 0
jmp 0x4150ec
mov eax, dword [ebp - 0x534]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret