joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d12f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 0x15], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x35], 0
je 0x5d132d
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jl 0x5d13ae
push ebp
mov al, 1
call fcn.005d1208
pop ecx
test al, al
jne 0x5d13ae
push ebp
mov al, 3
call fcn.005d1208
pop ecx
test al, al
jne 0x5d13ae
push ebp
mov al, 2
call fcn.005d1208
pop ecx
test al, al
jne 0x5d13ae
push ebp
mov al, 4
call fcn.005d1208
pop ecx
test al, al
jne 0x5d13ae
mov eax, dword [ebp - 4]
cmp byte [eax + 0x35], 0
je 0x5d137c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x41]
sub dword [ebp - 0x10], eax
push ebp
mov al, 1
call fcn.005d1208
pop ecx
test al, al
jne 0x5d13ae
push ebp
mov al, 3
call fcn.005d1208
pop ecx
test al, al
jne 0x5d13ae
push ebp
mov al, 2
call fcn.005d1208
pop ecx
test al, al
jne 0x5d13ae
push ebp
mov al, 4
call fcn.005d1208
pop ecx
test al, al
mov al, byte [ebp - 0x15]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5d2314
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5d23d1
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.005d1bb4
mov eax, dword [ebp - 8]
call fcn.005d2264
pop ecx
mov ebx, eax
test bl, bl
jne 0x5d2355
xor ebx, ebx
jmp 0x5d23bb
mov eax, ebx
add al, 0xd0
sub al, 0xa
jae 0x5d2374
xor eax, eax
mov al, bl
cmp di, ax
jne 0x5d2374
mov al, byte [0x5d23e4]
cmp al, byte [ebp - 1]
jne 0x5d2374
mov bl, 1
jmp 0x5d23bb
push ebx
call sub.USER32.DLL_VkKeyScanA
mov esi, eax
mov eax, esi
and ax, 0xff
cmp di, ax
jne 0x5d23b9
shr si, 8
mov bl, byte [0x5d23e4]
mov eax, esi
and ax, 1
cmp ax, 1
jne 0x5d23a0
or bl, 1
and si, 2
cmp si, 2
jne 0x5d23ad
or bl, 4
mov al, byte [ebp - 1]
cmp al, bl
sete al
mov ebx, eax
jmp 0x5d23bb
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d23d8
lea eax, [ebp - 8]
call fcn.004048ec
ret

Function at 0x5e7814
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
lea ecx, [esp + 8]
mov edx, ebx
mov eax, dword [ebx + 0x20]
call fcn.005d8e4c
push esp
call sub.USER32.DLL_GetCursorPos
push esp
mov eax, dword [ebx + 0x20]
call fcn.00476d64
push eax
call sub.USER32.DLL_ScreenToClient
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x5e785e
push dword [esp + 4]
push dword [esp + 4]
lea eax, [esp + 0x10]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
jne 0x5e7862
xor eax, eax
jmp 0x5e7864
mov al, 1
test al, al
je 0x5e7885
cmp byte [0x744d90], 0
je 0x5e7878
call fcn.005bfa44
jmp 0x5e7885
push 1
call sub.USER32.DLL_GetKeyState
test ax, ax
setl al
add esp, 0x18
pop ebx
ret
Function at 0x5f8b08
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [esp + 0x10], 1
sete byte [0x744d35]
cmp byte [0x744d35], 0
je 0x5f8b37
cmp dword [esp + 8], 0
je 0x5f8b3b
xor eax, eax
jmp 0x5f8b3d
mov al, 1
mov byte [0x744d34], al
cmp dword [esp + 0x10], 1
jne 0x5f8b50
cmp dword [esp + 8], 0
jne 0x5f8b62
cmp dword [esp + 0x10], 2
jne 0x5f8b5e
cmp dword [esp + 4], 5
je 0x5f8b62
xor eax, eax
jmp 0x5f8b64
mov al, 1
mov byte [0x744d36], al
add esp, 0x94
ret

Function at 0x626688
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov esi, dword [ebp + 8]
mov esi, dword [esi - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
push eax
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0xc]
mov eax, dword [ebp + 8]
mov dl, byte [eax + 0x34]
mov eax, dword [ebp + 8]
mov al, byte [eax - 1]
call fcn.00626e8c
mov ebx, eax
mov dl, 1
mov eax, dword [0x42d848]
call fcn.004345a0
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6267d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [esi + 0xc]
sub edx, dword [esi + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, dword [esi + 8]
sub edx, dword [esi]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x2c]
cdq
idiv ecx
imul ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x20]
mov ebx, eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
sub ebx, eax
sar ebx, 1
jns 0x626741
adc ebx, 0
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.0041de14
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x30]
call fcn.00434b70
push eax
mov eax, dword [ebp - 4]
call fcn.00434b70
pop ecx
pop edx
call fcn.0042f534
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
cmp byte [eax + 0x34], 3
setne al
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
call fcn.0042e358
push eax
push 0
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.0056468c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6267df
mov eax, dword [ebp - 4]
call fcn.0040399c
ret
Function at 0x64f7c8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 1], dl
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x64f940
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x64f82c
call fcn.0047091c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00476d64
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x64f821
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00476d64
push eax
call sub.USER32.DLL_ShowWindow
mov eax, dword [ebp - 8]
add eax, 0x18
call fcn.0040fb38
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
xor edx, edx
call fcn.00550804
mov eax, dword [ebp - 8]
mov byte [eax + 0x1c], 0
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 0x20]
test ebx, ebx
je 0x64f857
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 0x1c]
call fcn.0046d4b0
jmp 0x64f85f
lea eax, [ebp - 0xc]
call fcn.004048ec
push ebp
mov eax, dword [ebp - 0xc]
call fcn.0064f780
pop ecx
test al, al
je 0x64f92a
mov eax, dword [0x73e510]
mov eax, dword [eax]
xor ecx, ecx
mov dl, 1
call dword [eax + 0x2c]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], eax
lea eax, [ebp - 0x14]
call fcn.00552324
call fcn.0064f624
add dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 0x24]
push eax
mov eax, dword [0x73e8cc]
mov eax, dword [eax]
call fcn.0048e184
mov edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xd8]
mov esi, dword [ebp - 0x10]
mov eax, esi
add eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x34]
push eax
mov ebx, dword [ebp - 0x14]
mov ecx, ebx
add ecx, dword [ebp - 0x1c]
mov edx, esi
mov eax, ebx
call fcn.0041de14
lea esi, [ebp - 0x34]
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [0x73e390]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470584
mov eax, dword [0x73e390]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00474460
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xd0]
mov eax, dword [ebp - 8]
mov byte [eax + 0x1c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64f947
lea eax, [ebp - 0xc]
call fcn.004048ec
ret

Function at 0x661178
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.USER32.DLL_GetKeyboardState
mov eax, esp
call fcn.00487838
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret
Function at 0x66bc10
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x66bc3e
mov eax, ebx
call fcn.0066c6c4
cmp dword [ebx + 0x40], 0
je 0x66bc37
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x66bcaf
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x66bca1
cmp dword [ebx + 8], 0
je 0x66bc60
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x66bc72
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x66bca1
cmp dword [ebx + 8], 0
je 0x66bc53
cmp eax, 3
je 0x66bc85
dec eax
jne 0x66bc53
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x66bc53
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x66bc53
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x66bccd
cmp dword [ebx + 0x14], 0xcc
je 0x66bccd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0066bcd8
pop ebx
ret

Function at 0x6e893c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.006e8c70
mov eax, ebx
test eax, eax
je 0x6e8950
sub eax, 0xffffffb8
call fcn.0054c608
xor eax, eax
mov dword [ebx + 0x28], eax
lea eax, [ebx + 0x18]
push eax
call sub.USER32.DLL_SetRectEmpty
mov esi, dword [ebx + 0x40]
test esi, esi
je 0x6e8979
push 0
mov eax, esi
call fcn.00476d64
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret
Function at 0x716960
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x716bc0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x7169c3
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.007164a4
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040e730
cmp al, 1
jne 0x7169c3
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00716778
test al, al
je 0x716b4f
cmp dword [ebp - 8], 0
jge 0x7169e1
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.007164a4
mov eax, dword [ebp - 0x210]
call fcn.00404bbc
cmp ebx, eax
jge 0x716a2b
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.007164a4
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x73e8f8]
and eax, 0xff
bt dword [edx], eax
jae 0x716a2b
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x258]
cmp eax, dword [ebp - 8]
jg 0x716a3f
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0071693c
cmp ebx, dword [ebp - 8]
je 0x716b41
lea eax, [ebp - 0x108]
push eax
call sub.USER32.DLL_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x716a6b
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403ba4
and eax, 0x7f
movzx eax, word [eax*2 + 0x73d208]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.USER32.DLL_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x26c], 1
xor eax, eax
push ebp
push 0x716b2e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403ba4
and eax, 0x7f
movzx eax, word [eax*2 + 0x73d208]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00476d64
push eax
call sub.USER32.DLL_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403ba4
and eax, 0x7f
movzx eax, word [eax*2 + 0x73d208]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00476d64
push eax
call sub.USER32.DLL_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x716b35
mov eax, dword [ebp - 4]
mov byte [eax + 0x26c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x260], edx
jmp 0x716ba2
cmp dword [ebp - 8], 0
jge 0x716b5a
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.007164a4
mov eax, dword [ebp - 0x218]
call fcn.00404bbc
cmp eax, dword [ebp - 8]
jg 0x716b94
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.007164a4
mov eax, dword [ebp - 0x21c]
call fcn.00404bbc
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0071693c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x716bc7
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404910
ret
Function at 0x72dbf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcbc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x33c], eax
mov edi, dword [0x73d96c]
xor eax, eax
push ebp
push 0x72dda0
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0053622c
mov dword [edi], eax
cmp dword [edi], 0xffffffff
jne 0x72dc44
xor ebx, ebx
jmp 0x72dd82
mov dword [ebp - 0x332], 0x128
lea edx, [ebp - 0x332]
mov eax, dword [edi]
call fcn.0053624c
mov esi, eax
cmp esi, 1
sbb eax, eax
inc eax
test al, al
jne 0x72dd72
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor ebx, ebx
jmp 0x72dd82
call sub.KERNEL32.DLL_GetCurrentProcessId
cmp eax, dword [ebp - 0x32a]
jne 0x72dd63
mov eax, dword [ebp - 0x31a]
push eax
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov edx, dword [0x73e760]
mov dword [edx], eax
mov eax, dword [0x73e760]
cmp dword [eax], 0
je 0x72dd61
push 0x104
lea ecx, [ebp - 0x20a]
mov eax, dword [0x73e760]
mov eax, dword [eax]
xor edx, edx
call fcn.00536630
test eax, eax
je 0x72dd63
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov edx, 0x72ddb0
lea eax, [ebp - 0x105]
call fcn.0040a5e8
lea eax, [ebp - 0x33c]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00404b6c
mov eax, dword [ebp - 0x33c]
lea edx, [ebp - 0x338]
call fcn.00409578
mov eax, dword [ebp - 0x338]
push eax
lea eax, [ebp - 0x344]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404b6c
mov eax, dword [ebp - 0x344]
lea edx, [ebp - 0x340]
call fcn.00409578
mov edx, dword [ebp - 0x340]
pop eax
call fcn.00404d08
je 0x72dd5d
mov bl, 1
jmp 0x72dd63
xor ebx, ebx
jmp 0x72dd63
xor ebx, ebx
lea edx, [ebp - 0x332]
mov eax, dword [edi]
call fcn.0053626c
mov esi, eax
test esi, esi
jne 0x72dc7a
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72dda7
lea eax, [ebp - 0x344]
mov edx, 4
call fcn.00404910
ret

Function at 0x7ee23e
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.007ee2bd
jae 0x7ee24a
xor ecx, ecx
call fcn.007ee2bd
jae 0x7ee274
xor eax, eax
call fcn.007ee2bd
jae 0x7ee285
mov al, 0x10
call fcn.007ee2bd
adc al, al
jae 0x7ee266
jne 0x7ee2b2
stosb byte es:[edi], al
jmp 0x7ee24b
call fcn.007ee2c9
dec ecx
loop 0x7ee291
mov eax, ebp
call fcn.007ee2c7
jmp 0x7ee2b3
lodsb al, byte [esi]
shr eax, 1
je 0x7ee2d9
adc ecx, 2
mov ebp, eax
jmp 0x7ee2b3
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.007ee2c7
cmp eax, 0x7d00
jae 0x7ee2b1
cmp eax, 0x500
jae 0x7ee2b2
cmp eax, 0x7f
ja 0x7ee2b3
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7ee24b
pop ebp
ret 8
Function at 0x41f0ec
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push str.rstrtmgr.dll
call esi
push str.Kernel32.dll
mov ebx, eax
call esi
mov ebp, eax
test ebx, ebx
je 0x41f167
test ebp, ebp
je 0x41f167
push edi
push 0x14
call fcn.004dcef2
mov edi, eax
pop ecx
test edi, edi
je 0x41f15c
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.RmStartSession
push ebx
call esi
push str.RmRegisterResources
push ebx
mov dword [edi], eax
call esi
push str.RmGetList
push ebx
mov dword [edi + 4], eax
call esi
push str.RmEndSession
push ebx
mov dword [edi + 8], eax
call esi
push str.QueryFullProcessImageNameW
push ebp
mov dword [edi + 0xc], eax
call esi
mov dword [edi + 0x10], eax
jmp 0x41f15e
xor edi, edi
mov eax, dword [esp + 0x14]
mov dword [eax], edi
pop edi
jmp 0x41f16e
mov eax, dword [esp + 0x10]
and dword [eax], 0
pop esi
pop ebp
pop ebx
ret 4

Function at 0x42097b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x4209eb
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
je 0x4209eb
push ebx
mov ebx, 0x103
push edi
mov dword [ebp - 4], ebx
xor edi, edi
cmp edi, 0x64
jge 0x4209da
and dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 0xa
call fcn.0041edd5
pop ecx
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
inc edi
cmp dword [ebp - 4], ebx
je 0x4209af
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 4], ebx
pop edi
setne al
pop ebx
jmp 0x4209ed
xor al, al
pop esi
leave
ret

Function at 0x420b19
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
cmp dword [eax + 0x14], 8
jb 0x420b2a
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
push 2
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x420b5b
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x14], 8
jb 0x420b4a
mov eax, dword [eax]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
neg eax
sbb al, al
lea ebx, [eax + 1]
cmp dword [ebp + 0xc], 0
je 0x420b6a
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop ebp
ret
Function at 0x420b6f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [eax + 0x14], 8
jb 0x420b84
mov eax, dword [eax]
push ebx
lea ecx, [ebp - 4]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x420bd1
mov eax, dword [ebp + 0x14]
mov edx, dword [eax + 0x10]
add edx, edx
cmp dword [eax + 0x14], 8
jb 0x420bb0
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x14], 8
jb 0x420bbb
mov ecx, dword [ecx]
push edx
push eax
push 1
push ebx
push ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb al, al
lea ebx, [eax + 1]
cmp dword [ebp - 4], 0
je 0x420be0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret
Function at 0x44a400
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov eax, 0x100
push esi
push edi
cmp word [ecx + 4], ax
jbe 0x44a46e
mov esi, dword [ecx + 8]
mov esi, dword [esi]
mov eax, esi
mov ecx, dword [eax + 4]
cmp byte [ecx + 0xd], 0
jne 0x44a436
mov edx, dword [esp + 0x10]
cmp dword [ecx + 0x10], edx
jge 0x44a42c
mov ecx, dword [ecx + 8]
jmp 0x44a430
mov eax, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x44a422
mov dword [esp + 0x10], eax
cmp eax, esi
je 0x44a4b8
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
cmp ecx, edi
jge 0x44a4b8
push ebx
push ecx
lea ecx, [eax + 0x18]
call fcn.004498b0
lea ecx, [esp + 0x10]
call fcn.00445cb0
mov eax, dword [esp + 0x10]
cmp eax, esi
jne 0x44a446
pop edi
pop esi
pop ebx
ret 0xc
mov eax, dword [ecx + 8]
movzx edi, word [ecx + 6]
lea ecx, [esp + 0x10]
push dword [esp + 0x10]
shl edi, 5
push ecx
add edi, eax
push edi
push eax
call fcn.00445b00
mov esi, eax
add esp, 0x10
cmp esi, edi
je 0x44a4b8
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
nop dword [eax]
mov eax, dword [esi]
cmp eax, ebx
jge 0x44a4b7
push ebp
push eax
lea ecx, [esi + 8]
call fcn.004498b0
add esi, 0x20
cmp esi, edi
jne 0x44a4a0
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x44c940
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov ebp, dword [eax]
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [eax + 4]
imul eax, ebp, 0x100011b
mov edx, dword [esi + 0xc]
imul ecx, edi, 0x1000193
xor ecx, eax
and ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x44c97b
mov ecx, esi
jmp 0x44c980
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x44c9a1
cmp dword [eax + 8], ebp
jne 0x44c98e
cmp dword [eax + 0xc], edi
je 0x44c992
mov eax, dword [eax]
jmp 0x44c973
cmovne eax, esi
cmp eax, esi
je 0x44c9a1
mov eax, dword [eax + 0x10]
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x470b10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov ebp, ecx
mov edx, edi
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [esp + 0x24], ebx
jb 0x470b2e
mov edx, dword [edi]
xor esi, esi
lea ecx, [edx + ebx]
cmp edx, ecx
mov eax, 0x811c9dc5
cmova ebx, esi
test ebx, ebx
je 0x470b54
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
inc esi
imul eax, ecx, 0x1000193
cmp esi, ebx
jne 0x470b41
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 4]
and ecx, eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + ecx*8]
add ecx, ecx
mov edx, dword [eax + ecx*4]
lea eax, [eax + ecx*4]
add eax, 4
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
cmp edx, ebx
jne 0x470b7d
mov eax, ebx
jmp 0x470b81
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x470bec
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x470b8f
mov edx, dword [edi]
mov ebp, dword [esi + 0x1c]
lea ecx, [esi + 8]
cmp ebp, 0x10
jb 0x470b9d
mov ecx, dword [esi + 8]
push dword [esp + 0x24]
mov eax, dword [esi + 0x18]
push edx
push eax
push ecx
mov dword [esp + 0x28], eax
call fcn.004092c8
add esp, 0x10
test al, al
jne 0x470bc3
mov esi, dword [esi]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
jmp 0x470b75
lea eax, [esi + 8]
cmp ebp, 0x10
jb 0x470bcd
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
jb 0x470bd5
mov edi, dword [edi]
push dword [esp + 0x18]
push eax
push dword [esp + 0x2c]
push edi
call fcn.004092c8
add esp, 0x10
test al, al
cmovne ebx, esi
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ebx
pop ebx
add esp, 0xc
ret 8