joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40daa0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x425024]
test eax, eax
je 0x40dab9
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x40dad2
jmp 0x40dae1
push 0x425024
call fcn.0040b4f0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x40dae1
cmp dword [eax], 1
mov edi, eax
jne 0x40dae1
add edi, 4
mov eax, edi
pop esi
pop edi
ret
mov eax, dword [0x425024]
test eax, eax
je 0x40db00
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40db18
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x40dadc
jmp 0x40db55
push 0x425024
call fcn.0040b4f0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x40daf5
push 4
push 0xc
call fcn.004026c0
add esp, 8
test eax, eax
je 0x40db8c
mov dword [eax], 0
mov dword [eax + 8], 0x425024
mov esi, eax
mov eax, dword [0x425024]
test eax, eax
jne 0x40db4d
push 0x425024
call fcn.0040b4f0
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 4]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
je 0x40dadc
test ecx, ecx
je 0x40dadc
lock dec dword [ecx]
jne 0x40dadc
call fcn.004059b0
mov eax, edi
pop esi
pop edi
ret
push 4
push 0xc
call fcn.0041d5b0
add esp, 8
ud2

Function at 0x40dc60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x42502c]
test eax, eax
je 0x40dc79
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x40dc92
jmp 0x40dca1
push 0x42502c
call fcn.0040b4f0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x40dca1
cmp dword [eax], 1
mov edi, eax
jne 0x40dca1
add edi, 4
mov eax, edi
pop esi
pop edi
ret
mov eax, dword [0x42502c]
test eax, eax
je 0x40dcc0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40dcd8
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x40dc9c
jmp 0x40dd15
push 0x42502c
call fcn.0040b4f0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x40dcb5
push 4
push 0x10
call fcn.004026c0
add esp, 8
test eax, eax
je 0x40dd53
mov dword [eax], 0
mov dword [eax + 0xc], 0x42502c
mov esi, eax
mov eax, dword [0x42502c]
test eax, eax
jne 0x40dd0d
push 0x42502c
call fcn.0040b4f0
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
je 0x40dc9c
test ecx, ecx
je 0x40dc9c
lock dec dword [ecx]
jne 0x40dc9c
call fcn.00405970
mov eax, edi
pop esi
pop edi
ret
push 4
push 0x10
call fcn.0041d5b0
add esp, 8
ud2
Function at 0x40e0c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4104c0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 4
push 8
call fcn.004026c0
add esp, 8
test eax, eax
je 0x40e1b1
mov edx, dword [ebp + 0xc]
mov edi, eax
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
add edx, 0xfffe
mov dword [edi], ecx
mov dword [edi + 4], eax
and edx, 0xffff0001
push 0
push 0x10000
push edi
push 0x40e1e0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40e141
mov dword [esi + 4], eax
xor eax, eax
jmp 0x40e19c
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], eax
push eax
mov dword [ebp - 0x24], ecx
call dword [ecx]
add esp, 4
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp + 8]
mov eax, dword [ecx + 4]
test eax, eax
je 0x40e178
push dword [ecx + 8]
push eax
push dword [ebp - 0x20]
call fcn.004026d0
add esp, 0xc
push 4
push 8
push dword [ebp - 0x28]
call fcn.004026d0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
mov dword [esi], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push 4
push 8
call fcn.0041d5b0
add esp, 8
ud2
Function at 0x40e3e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4104f0
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
cmp eax, 3
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x40e41e
test eax, eax
jne 0x40e5a3
mov edi, dword [0x42525c]
test edi, edi
je 0x40e5a3
mov dword [ebp - 0x20], 0
jmp 0x40e447
mov edi, dword [edi + 8]
test edi, edi
je 0x40e47d
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40e440
mov esi, eax
push 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [edi]
mov cl, 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], ecx
push esi
mov dword [ebp - 0x24], edi
call eax
mov edi, dword [ebp - 0x24]
add esp, 4
jmp 0x40e440
test byte [ebp - 0x20], 1
je 0x40e5a3
mov edi, dword [0x42525c]
test edi, edi
je 0x40e5a3
mov dword [ebp - 0x20], 0
jmp 0x40e4a7
mov edi, dword [edi + 8]
test edi, edi
je 0x40e4dd
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40e4a0
mov esi, eax
push 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [edi]
mov cl, 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], ecx
push esi
mov dword [ebp - 0x24], edi
call eax
mov edi, dword [ebp - 0x24]
add esp, 4
jmp 0x40e4a0
test byte [ebp - 0x20], 1
je 0x40e5a3
mov edi, dword [0x42525c]
test edi, edi
je 0x40e5a3
mov dword [ebp - 0x20], 0
jmp 0x40e507
mov edi, dword [edi + 8]
test edi, edi
je 0x40e53d
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40e500
mov esi, eax
push 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [edi]
mov cl, 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], ecx
push esi
mov dword [ebp - 0x24], edi
call eax
mov edi, dword [ebp - 0x24]
add esp, 4
jmp 0x40e500
test byte [ebp - 0x20], 1
je 0x40e5a3
mov edi, dword [0x42525c]
test edi, edi
je 0x40e5a3
mov dword [ebp - 0x20], 0
jmp 0x40e567
mov edi, dword [edi + 8]
test edi, edi
je 0x40e59d
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40e560
mov esi, eax
push 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [edi]
mov cl, 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], ecx
push esi
mov dword [ebp - 0x24], edi
call eax
mov edi, dword [ebp - 0x24]
add esp, 4
jmp 0x40e560
test byte [ebp - 0x20], 1
jne 0x40e5bb
mov al, byte [0x421fc0]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edi, dword [0x42525c]
jmp 0x40e5c6
mov edi, dword [edi + 8]
test edi, edi
je 0x40e5a3
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40e5c3
mov esi, eax
push 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [edi]
mov dword [ebp - 0x10], 0
push esi
mov dword [ebp - 0x24], edi
call eax
mov edi, dword [ebp - 0x24]
add esp, 4
jmp 0x40e5c3
Function at 0x40f750
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x425038]
test eax, eax
je 0x40f768
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x40f781
jmp 0x40f78c
push 0x425038
call fcn.0040b4f0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x40f78c
cmp dword [eax], 1
mov esi, eax
je 0x40f80d
mov eax, dword [0x425038]
test eax, eax
je 0x40f7ab
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40f7c3
xor esi, esi
cmp eax, 1
je 0x40f810
mov esi, eax
jmp 0x40f800
push 0x425038
call fcn.0040b4f0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x40f7a0
push 4
push 0xc
call fcn.004026c0
add esp, 8
test eax, eax
je 0x40f814
mov dword [eax], 0
mov dword [eax + 8], 0x425038
mov esi, eax
mov eax, dword [0x425038]
test eax, eax
jne 0x40f7f8
push 0x425038
call fcn.0040b4f0
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 1
mov dword [esi + 4], 0
add esi, 4
mov eax, esi
pop esi
ret
push 4
push 0xc
call fcn.0041d5b0
add esp, 8
ud2
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00402767
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00402767
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00402767
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00402767
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00402767
mov dword [0x41203c], eax
call fcn.00402767
test eax, eax
jge 0x402550
push 8
call fcn.00402767
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00402767
pop ecx
push 1
call fcn.00402767
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00402767
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00402767
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00402767
jmp 0x402495

Function at 0x402767
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x402776
pop dword [ebp - 0x38]
mov eax, 0x402776
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x3897e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x88f2d554
sub ecx, 0x88f2923b
mov ebx, eax
mov edi, 0x413bc4
add edi, dword [ebp - 0x38]
mov edx, 0xe3c61f69
add edx, 0x134e654a
sub dword [ebp - 0x24], 0x219d0ea0
mov esi, dword [edi]
xor dword [ebp - 0x28], esi
sub esi, edx
mov dword [ebx], esi
mov dword [ebp - 0x14], 0xf093ecc8
add ebx, 0x6ad287c
add ebx, 0xf952d788
add edi, 4
loop 0x4027c5
add eax, 0xad1b5381
sub eax, 0xad1a544a
xor ebx, ebx
add ebx, eax
add eax, 0x36956e5e
sub eax, 0x36956e59
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x404b24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x404b33
pop dword [ebp - 0x44]
mov eax, 0xd356f5f
sub eax, 0xcf5242c
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x309afbc1
sub dword [ebp - 0x54], 0xe248b676
mov dword [ebp - 0x50], 0x3daf717d
sub dword [ebp - 0x50], 0xb7c2538
mov dword [ebp - 0x4c], 0x5b3f7ead
sub dword [ebp - 0x4c], 0xef33a7f
mov dword [ebp - 0x48], 0xaf5da84c
add dword [ebp - 0x48], 0x50a257b4
lea eax, [ebp - 0x54]
push eax
mov eax, 0xaa0d91fb
add eax, 0x56349e79
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xfd6878c5
sub dword [ebp - 0x54], 0x88f60f6f
mov dword [ebp - 0x50], 0x318835f0
sub dword [ebp - 0x50], 0xf01bd47b
mov dword [ebp - 0x4c], 0x1fdd7c12
sub dword [ebp - 0x4c], 0xbc6e0fa6
mov dword [ebp - 0x48], 0xa45eb24a
sub dword [ebp - 0x48], 0xa45eb24a
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3ec18
push 0
call eax
mov ecx, 0x291734ea
add ecx, 0xd6e91738
xor edx, edx
add edx, eax
mov esi, 0xe87cd690
add esi, 0x17c66d70
add esi, dword [ebp - 0x44]
mov ebx, 0x51a9d3fa
add dword [ebp - 0x3c], 0xa2f6b0cb
mov edi, dword [esi]
xor dword [ebp - 0x24], eax
add edi, ebx
xor dword [ebp - 0x38], ecx
mov dword [edx], edi
mov dword [ebp - 0x10], 0xf82b85d5
add edx, 4
add esi, 4
loop 0x404c4c
add eax, 0x1235b
mov ebx, eax
add eax, 0xc6c528f9
add eax, 0x393ad70c
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x423c74
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x44d75c], 0
sete dl
or al, dl
jne 0x423db8
mov eax, dword [0x44d760]
mov bx, 0xffff
call fcn.00402f50
mov eax, dword [0x44d75c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x423d87
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x44d75c]
call fcn.0040f124
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
je 0x423d7f
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x16c], 0
je 0x423d7f
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x423d7f
mov eax, dword [ebp - 0x10]
call fcn.0042bbc8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x423d7f
push ebp
call fcn.00423c30
pop ecx
test al, al
jne 0x423d7f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x8c]
cmp eax, dword [ebp - 0x10]
jne 0x423d3b
mov eax, dword [ebp - 0x10]
call fcn.0042a4d8
dec eax
jle 0x423d7f
mov byte [ebp - 0x15], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x15]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov bx, 0xffc2
call fcn.00402f50
cmp byte [ebp - 0x15], 0
je 0x423d7f
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x423d7f
mov edx, dword [ebp - 0x10]
mov eax, dword [0x44d760]
call fcn.004234e0
inc edi
dec esi
jne 0x423cce
mov eax, dword [0x44d760]
cmp dword [eax + 8], 0
jle 0x423d9f
mov eax, dword [0x44d760]
call fcn.00423570
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x423db8
push ebp
mov eax, dword [ebp - 0x14]
call fcn.00423ae8
pop ecx
test al, al
jne 0x423db8
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425a58
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosd dword es:[edi], eax
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.004257f2
ficom word [ebp - 0x21]
pop ds
lea eax, [ebp - 0x58]
push eax
call fcn.00425802
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004257b7
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x425ae0
invalid
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004257f2
xchg byte [ebx + 0x49], dl
jo 0x425ac2
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x425bb8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg esi, eax
mov esi, 0xc6975d88
inc ebp
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00425802
push eax
push esi
push dword [ebp + 8]
call fcn.004257b7
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00425802
push eax
push esi
push dword [ebp + 8]
call fcn.004257b7
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004257f2
shl ebx, 0x25
mov ebx, 0xff7c9d88
invalid
Function at 0x427388
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.00425802
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.00425763
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x42776a

Function at 0x429664
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x429695
je 0x4296ef
sub eax, 7
je 0x4296b6
dec eax
je 0x4296e0
sub eax, 0x17
je 0x429770
jmp 0x4297ae
add eax, 0xffffff00
sub eax, 9
jb 0x42975c
add eax, 0xffffff09
sub eax, 0xb
jb 0x429746
jmp 0x4297ae
mov eax, ebx
call fcn.00439a04
mov edi, eax
test edi, edi
je 0x42980e
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xc8]
test al, al
je 0x429817
jmp 0x42980e
test byte [ebx + 0x44], 0x20
jne 0x429817
jmp 0x42980e
mov edx, esi
mov eax, ebx
call fcn.00426f08
cmp dword [esi + 0xc], 0xffffffff
jne 0x429817
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00406be0
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.00425984
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.00429514
test eax, eax
je 0x429817
mov dword [esi + 0xc], 1
jmp 0x429817
mov edx, esi
mov eax, ebx
call fcn.004295d8
test al, al
jne 0x429817
jmp 0x42980e
mov eax, ebx
call fcn.00426574
test al, al
jne 0x429817
jmp 0x42980e
mov eax, ebx
call fcn.0042bbc8
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x42980e
cmp dword [0x44c720], 0
je 0x42980e
mov eax, dword [0x44c720]
cmp ebx, dword [eax + 0x24]
jne 0x42980e
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x44c720]
call fcn.00426e24
jmp 0x42980e
mov eax, dword [0x44d724]
cmp byte [eax + 0x20], 0
je 0x42980e
mov eax, dword [0x44d724]
cmp dword [eax + 0x1c], 0
je 0x42980e
mov eax, dword [esi]
mov edx, dword [0x44d724]
cmp eax, dword [edx + 0x1c]
jne 0x42980e
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.00439918
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb9
call fcn.00402f50
jmp 0x429817
mov edx, esi
mov eax, ebx
call fcn.00426f08
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429ca8
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x429cc4
cmp dword [esi + 4], 0
je 0x429cf1
test byte [ebx + 0x45], 1
jne 0x429ce3
mov eax, ebx
call fcn.00428d18
test eax, eax
jne 0x429ce3
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x429e01
mov edx, esi
mov eax, ebx
call fcn.00429920
jmp 0x429e01
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x429dfa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0042bbc8
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00426e24
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00429ca8
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0042bbc8
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429e01
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4333a0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403914
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x433401
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x433401
cmp byte [ebp - 0x102], 0
je 0x433401
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403b40
pop ebx
mov esp, ebp
pop ebp
ret