joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65a41cb0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x65a4603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x65a46034]
sub esp, 4
test ebx, ebx
je 0x65a41cfb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x65a41cf4
test esi, esi
je 0x65a41cf4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x65a41cd0
mov dword [esp], 0x65a4603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x65a41ee0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x65a4420c
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x65a41f30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x65a42008
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x65a41f6e
cmp eax, 4
jne 0x65a41f90
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x65a41f7e
cmp edx, 4
je 0x65a41f7e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.65a41ee0
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x401d30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xea644
call fcn.00403360
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xea620], 0
push eax
push eax
push eax
mov word [ebp - 0xea60c], ax
lea eax, [ebp - 0xea61c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xea620]
mov dword [ebp - 0xea61c], 0x10001
push eax
mov dword [ebp - 0xea618], 0x7d00
mov dword [ebp - 0xea614], 0x7d00
mov dword [ebp - 0xea610], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xea600
lea eax, [ebp - 0xea608]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, 8
lea eax, [ebp - 0xea608]
add esp, 0xc
xor ebx, ebx
sub edi, eax
mov eax, 0xa57eb503
lea esi, [ebp - 0xea608]
mul ebx
add esi, ebx
shr edx, 6
movsx eax, dl
mov dl, bl
imul eax, eax, 0x63
lea ecx, [edi + esi]
sub dl, al
mov al, bl
xor al, 0x32
or dl, al
mov eax, ebx
shr eax, cl
inc ebx
xor dl, al
mov byte [esi], dl
cmp ebx, 0xea600
jb 0x401dc3
lea eax, [ebp - 0xea608]
mov dword [ebp - 0xea63c], 0xea600
mov dword [ebp - 0xea640], eax
lea eax, [ebp - 0xea640]
push 0x20
push eax
push dword [ebp - 0xea620]
mov dword [ebp - 0xea638], 0
mov dword [ebp - 0xea634], 0
mov dword [ebp - 0xea630], 0
mov dword [ebp - 0xea62c], 0
mov dword [ebp - 0xea628], 0
mov dword [ebp - 0xea624], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xea640]
push eax
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xea640]
push eax
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004026b4
mov esp, ebp
pop ebp
ret
Function at 0x402030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c4
call fcn.00403360
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov cl, al
mov ebx, eax
shl cl, 4
mov edx, eax
shr ebx, 8
neg edx
and bl, cl
shr edx, 4
mov ecx, eax
shr ecx, 4
xor bl, cl
mov cl, al
shl cl, 2
xor bl, cl
mov cl, al
add cl, cl
and dl, cl
or bl, dl
mov byte [ebp + eax - 0x3a988], bl
inc eax
cmp eax, 0x3a980
jb 0x4020b4
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004026b4
mov esp, ebp
pop ebp
ret
Function at 0x4021a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xea640
call fcn.00403360
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xea620], 0
push eax
push eax
push eax
mov word [ebp - 0xea60c], ax
lea eax, [ebp - 0xea61c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xea620]
mov dword [ebp - 0xea61c], 0x10001
push eax
mov dword [ebp - 0xea618], 0x7d00
mov dword [ebp - 0xea614], 0x7d00
mov dword [ebp - 0xea610], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xea600
lea eax, [ebp - 0xea608]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov esi, 0x4e1f
xor ebx, ebx
nop word [eax + eax]
mov cl, bl
mov al, bl
shl cl, 2
shl al, 3
movsx eax, al
lea edx, [ecx + ebx]
movsx ecx, dl
xor eax, ecx
cdq
idiv esi
mov byte [ebp + ebx - 0xea608], dl
inc ebx
cmp ebx, 0xea600
jb 0x402230
lea eax, [ebp - 0xea608]
mov dword [ebp - 0xea63c], 0xea600
mov dword [ebp - 0xea640], eax
lea eax, [ebp - 0xea640]
push 0x20
push eax
push dword [ebp - 0xea620]
mov dword [ebp - 0xea638], 0
mov dword [ebp - 0xea634], 0
mov dword [ebp - 0xea630], 0
mov dword [ebp - 0xea62c], 0
mov dword [ebp - 0xea628], 0
mov dword [ebp - 0xea624], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xea640]
push eax
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xea640]
push eax
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004026b4
mov esp, ebp
pop ebp
ret
Function at 0x402310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00403360
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
shr edx, 7
xor dl, al
add dl, al
xor dl, 5
mov cl, dl
shl dl, 2
add cl, dl
mov byte [ebp + eax - 0x3a988], cl
inc eax
cmp eax, 0x3a980
jb 0x402393
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026b4
mov esp, ebp
pop ebp
ret
Function at 0x402eea
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402f29
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402f29
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402f29
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402f29
cmp dword [ecx + 0x74], 0xe
jbe 0x402f29
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x510024
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
add al, byte [eax]
add byte [eax], al
cld
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
cld
invalid
stc
jb 0x51002e
pop ds
xor esi, dword [ecx - 0x49]
jno 0x50ffe2
cwde
leave
jmp 0x51008f
pushal
jmp 0x510034
call 0x51003f
dec ecx
stc
mov dl, 0xed
pop ecx
pop ebx
jb 0x510049
jne 0x50ffd9
jge 0x510029
sbb dword [edx - 0x383c7edc], 0xffffffff
invalid
add ebx, 0xffffffc7
jmp 0x510058
cmp dword [ebx], 0
stc
jmp 0x510067
je 0x5100ed
jmp 0x510076
mov ecx, ebx
jmp 0x510081
add ebx, 4
jmp 0x510089
mov edx, dword [ebx]
jmp 0x510097
and eax, 0x8ced9cec
in eax, dx
cmp ebp, dword [ebx + 3]
sar ecx, cl
add edx, ebx
stc
jb 0x5100a3
mov ah, 0xb1
mov ebx, 0xc91a740d
mov eax, dword [ebx + 4]
jmp 0x5100ac
sub dword [edx], 0x3c62176a
jmp 0x5100b6
add edx, 4
jmp 0x5100bf
sub eax, 1
jmp 0x5100c6
jne 0x5100a6
jmp 0x5100d0
add ebx, 8
jmp 0x5100d7
sub dword [ecx], 1
stc
jb 0x5100de
and ecx, dword [edi]
test dword [eax + 0x72ffffff], esp
add dh, byte [ecx + 0xee83b]
add byte [eax], al
jne 0x510084
jb 0x5100e8
mov cl, 0x3b
call 0x5100fb
jmp 0x5100f1
popal
jmp 0x5100f6
jmp 0x50ed00
Function at 0x40d04b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40d05a
pop dword [ebp - 0x1c]
mov eax, 0x40d05a
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x16c13718
add dword [ebp - 0x2c], 0x37910e33
mov dword [ebp - 0x28], 0xe3a427dc
sub dword [ebp - 0x28], 0xb170db97
mov dword [ebp - 0x24], 0x10a8c918
add dword [ebp - 0x24], 0x3ba37b16
mov dword [ebp - 0x20], 0x45488ed8
sub dword [ebp - 0x20], 0x45488ed8
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xe4b17c2e
add eax, 0x1b8f64ce
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x171ce294
add dword [ebp - 0x2c], 0x5d5586c2
mov dword [ebp - 0x28], 0x55c61b9f
add dword [ebp - 0x28], 0xeba645d6
mov dword [ebp - 0x24], 0x3a88fdcd
add dword [ebp - 0x24], 0x28e66e9f
mov dword [ebp - 0x20], 0x8959b876
add dword [ebp - 0x20], 0x76a6478a
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3cf44
push 0
call eax
mov ecx, 0xfbad5fcb
sub ecx, 0xfbad02cb
mov esi, eax
mov edx, 0x41f000
add edx, dword [ebp - 0x1c]
mov edi, 0xb6c204da
sub edi, 0x74fb3235
xor dword [ebp - 8], eax
mov ebx, dword [edx]
sub ebx, edi
xor dword [ebp - 4], edi
mov dword [esi], ebx
add dword [ebp - 0xc], ecx
add esi, 0x79ed142e
sub esi, 0x79ed142a
add edx, 0x14609411
sub edx, 0x1460940d
loop 0x40d16c
add eax, 0xf352dfc1
sub eax, 0xf35178ee
mov ebx, eax
add eax, 0xd2f84869
add eax, 0x2d07b79c
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x402c00
pop dword [ebp - 0x18]
mov eax, 0x3f41be5f
add eax, 0xc0fe6da1
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x80248ad2
sub dword [ebp - 0x28], 0x31d24587
mov dword [ebp - 0x24], 0xa13523e4
add dword [ebp - 0x24], 0x90fe2861
mov dword [ebp - 0x20], 0xaf0d2086
add dword [ebp - 0x20], 0x9d3f23a8
mov dword [ebp - 0x1c], 0x7b6bb9da
add dword [ebp - 0x1c], 0x84944626
lea eax, [ebp - 0x28]
push eax
mov eax, 0xb1c0d9d0
sub eax, 0xb1805944
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xe96f0aa2
add dword [ebp - 0x28], 0x8b035eb4
mov dword [ebp - 0x24], 0x811e2807
add dword [ebp - 0x24], 0xc04e396e
mov dword [ebp - 0x20], 0x4bd00f8
sub dword [ebp - 0x20], 0xa14d948c
mov dword [ebp - 0x1c], 0x33b82858
add dword [ebp - 0x1c], 0xcc47d7a8
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x8c0764d8
sub eax, 0x8bc6e404
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x36b12
push 0
call eax
mov ecx, 0xbd4deefa
add ecx, 0x42b25909
mov edi, eax
mov ebx, 0xc94510b9
sub ebx, 0xc90400b9
add ebx, dword [ebp - 0x18]
mov edx, 0x7f2334ba
sub dword [ebp - 0xc], 0xb1f7a339
mov esi, dword [ebx]
xor dword [ebp - 8], ecx
sub esi, edx
add dword [ebp - 4], esi
mov dword [edi], esi
sub dword [ebp - 4], 0x79067379
add edi, 0xfd553951
add edi, 0x2aac6b3
add ebx, 4
loop 0x402d1c
add eax, 0x28185a68
add eax, 0xd7e8b877
mov ebx, eax
add eax, 0xc627164f
sub eax, 0xc627164a
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x405ee9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x405f0d
xor eax, eax
test eax, eax
je 0x405f1f
cmp byte [ebp + eax - 0x121], 0x5c
je 0x405f1f
xor ecx, ecx
jmp 0x405f22
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409010]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x405fc6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c634], 0
push esi
jne 0x405ffd
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405fd7
mov dword [ecx*4 + 0x42c630], eax
inc ecx
cmp ecx, 0x100
jl 0x405fd2
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40602e
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c630]
xor eax, esi
inc ecx
dec edx
jne 0x406010
pop edi
not eax
pop esi
ret 0xc

Function at 0x10001360
Capabilities:
Log keystrokes via application hook

Disassembly:
push ecx
mov eax, dword [0x10003028]
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0
push eax
push 0x10001200
push 2
mov byte [esp + 0x14], 0
call esi
mov ecx, dword [0x10003028]
push 0
push ecx
push 0x100010f0
push 7
mov dword [section..GLDATA], eax
call esi
mov ecx, dword [section..GLDATA]
mov dword [0x10004004], eax
test ecx, ecx
je 0x1000143f
test eax, eax
je 0x1000143f
push str.EldoS_Activity_Monitor_Mapping
push 0x1c
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [0x10003030], eax
je 0x1000143f
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [0x1000302c], eax
je 0x1000143f
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [eax], 0x1c
call esi
mov edx, dword [0x1000302c]
mov dword [edx + 4], eax
call esi
mov ecx, dword [0x1000302c]
mov byte [esp + 4], 1
pop esi
mov dword [ecx + 8], eax
mov edx, dword [0x1000302c]
mov dword [edx + 0xc], 0
mov eax, dword [0x1000302c]
mov dword [eax + 0x14], 0xffffffff
mov ecx, dword [0x1000302c]
mov eax, dword [esp]
mov dword [ecx + 0x18], 0xffffffff
and eax, 0xff
pop ecx
ret
call sym.ActivityMon.dll_UninstallMonitor
mov eax, dword [esp + 4]
pop esi
and eax, 0xff
pop ecx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40d7cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40d7de
pop dword [ebp - 0x1c]
mov eax, 0xc8a084f5
sub eax, 0xc85fad17
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x35db3
push 0
mov eax, 0x59b8b
sub eax, 0xffc4bab3
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x3a92
xor esi, esi
add esi, eax
mov edx, 0x497ae7f5
sub edx, 0x4939ac31
add edx, dword [ebp - 0x1c]
mov ebx, 0xc8bf7c77
sub ebx, 0x28d20e95
mov dword [ebp - 4], 0x40a973a5
mov edi, dword [edx]
sub dword [ebp - 0x18], ebx
xor edi, ebx
sub dword [ebp - 0x18], 0x6087b5c4
mov dword [esi], edi
sub dword [ebp - 0xc], 0x16769255
add esi, 0x98390abc
sub esi, 0x98390ab8
add edx, 0x7fb35bd8
add edx, 0x804ca42c
loop 0x40d839
add eax, 0x66bafb45
add eax, 0x9945e1d6
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret