joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5253f0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x409486
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x408978
xor eax, eax
mov ecx, 7
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
mov ecx, 7
lea edi, [ebp - 0x4c]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
call fcn.0041fd94
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov edi, eax
call esi
lea ecx, [ebp - 0x50]
push ecx
push 0xf00ff
push edi
call fcn.0041fe30
call esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
lea edx, [ebp - 0x5c]
push edx
push 0x418cac
lea eax, [ebp - 0x68]
push eax
call edi
push eax
push 0x4187f4
lea ecx, [ebp - 0x64]
push ecx
call edi
push eax
call fcn.0041fde4
call esi
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x64]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x48]
push edx
push 8
mov dword [ebp - 0x4c], 1
call dword [sym.imp.MSVBVM60.DLL___vbaCopyBytes]
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x2c]
push ecx
push 0x1c
lea edx, [ebp - 0x4c]
push edx
push ebx
push eax
mov dword [ebp - 0x40], 2
call fcn.0041fd48
call esi
push 0x5254f3
jmp 0x5254f2
ret
Function at 0x1e7a3ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ebp + 0x5d88d445]
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1e7a38d5
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a388a
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1e7a38c5
mov dh, 0x62
cmp al, al
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b

Function at 0x1e7a3d70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.1e7a38c5
imul eax, dword [esi - 0x52], 0x27
invalid
invalid
invalid

Function at 0x1e7a3f20
Capabilities:
Inspect section memory permissions

Disassembly:
add eax, esi
cmp dword [eax], ebx
je 0x1e7a3f79
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1e7a3f74
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1e7a3f5e
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1e7a3f66
cmp edx, ebx
jne 0x1e7a40b4
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1e7a3f35
add eax, dword [eax + 4]
jmp 0x1e7a3f22
mov dword [ebp + 0xc], ebx
jmp 0x1e7a3f84
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7a3f9c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7a3fba
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
Function at 0x1e7a3fc0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7a4018
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
add byte [eax], al
invalid
invalid
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7a3fff
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a4008
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a4012
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7a3ff4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1e7a3f7e
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x1e7a3ff0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7a4018
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
add byte [eax], al
invalid
invalid
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7a3fff
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a4008
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a4012
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7a3ff4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1e7a3f7e
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x1e7a4150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ebp + 0x55fffffc], edi
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.1e7a38d5
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a388a
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
invalid

Function at 0x1e7a43f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov al, byte [0xb0fffff9]
mov byte [ebp - 0x65f], 0x9d
invalid
invalid
invalid
stc

Function at 0x1e7a4470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
invalid
test eax, ebp
cli
invalid
invalid
Function at 0x1e7a47e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, 0x8fffff0
mov al, byte [0x2ff845c6]
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.1e7a38d5
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a388a
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.1e7a38c5
add ecx, dword [ecx + 0x468a39e]
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid

Function at 0x1e7a4c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x6cc], 0
je 0x1e7a5a58
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.1e7a3836
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x1e7a4cd2
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x1e7a4d1b
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x1e7a4cc5
call fcn.1e7a38c5
scasb al, byte es:[edi]
jecxz 0x1e7a4d89
test byte [eax - 0x72b5b], 0xff
add byte [eax - 0x72a5b], al
inc dword [eax]
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
clc
invalid

Function at 0x1e7a4d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.1e7a38c5
push edx
loope 0x1e7a4d56
test ebx, ebx
clc
invalid
ret 0x858d
Function at 0x1e7a55d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.1e7a38d5
call [ecx + 0x50]
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.1e7a3836
add esp, 0xc
jmp 0x1e7a583d
Function at 0x1022b372
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x10]
jl 0x1023033c
jb 0x10235148
clc
cmp eax, dword [ebp - 0x10]
jmp 0x10232bf5
bt ecx, 6
pushal
cmc
sub al, al
clc
bt dx, 0xd
repne scasb al, byte es:[edi]
pushfd
pushfd
mov byte [esp], cl
pushfd
lea esp, [esp + 0x2c]
jne fcn.10235135
pushal
call 0x10237555
push 0x18431459
lea esp, [esp + 4]
jae 0x10235148
rcr ebx, 0x1f
rol edi, cl
mov ebx, eax
rol cx, cl
cmc
sbb edi, ebx
mov edi, eax
rol cx, cl
bsf cx, di
mov ecx, 0x104
jmp 0x1022ba68

Function at 0x1022c166
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmc
jmp 0x1022c89a
rol al, 3
jmp 0x1022fe17
cmp al, byte [edi]
pushfd
lea edi, [edi + 1]
lahf
push 0x7c882b1c
setbe ah
mov eax, dword [esp + 0x4c]
call fcn.1023ad56

Function at 0x1022c2cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp]
stc
xor al, al
push 0xe40dd0d2
repne scasb al, byte es:[edi]
push 0xb14e8ff8
pushfd
push 0x43cf9f87
lea esp, [esp + 0x1c]
jne fcn.10235135
sar si, 9

Function at 0x1022d344
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp], cl
mov dword [ebp - 4], eax
pushal
jmp fcn.102338f3

Function at 0x1022d463
Capabilities:
Check for software breakpoints

Disassembly:
aaa
in al, 0x53
lodsb al, byte [esi]
imul eax, dword [ebx + 0x53], 0xffffff90
xlatb
inc edi
invalid
popfd
cmp al, 0xf3
popfd
jecxz 0x1022d424
aaa
out dx, eax
cwde
sub al, 0xcd
in al, dx
cdq
dec esi
xchg ebx, eax
push edx
sbb esp, dword [edi + 0x52]
jno 0x1022d483
dec esi
push esi
push eax
mov esp, 0x45eaaff4
sal dword [ecx], 1
lds edx, [edx + 0x10efd779]
aaa
test eax, 0x12547c4a
cwde
idiv dword [edi - 0x77]
mov edi, ebx
mov edi, ebx
shr al, cl
shl al, cl
bt cx, di
sbb al, ch
mov al, 0x2e
pushfd
stc
repne scasb al, byte es:[edi]
push dword [esp]
xor al, 0x24
push dword [esp]
pushfd
call fcn.1023312c
loop 0x1022d4cf
cmpsd dword [esi], dword es:[edi]
salc
and ecx, dword [eax - 0x17474d52]
cmp byte [eax + 0x48], 0xcc
ja 0x1022d434
mov ebp, 0x64c31432
inc dword [edx + 0x1c418f51]
mov ds, word [ecx - 0x2b]
dec ebx
fsub qword [ebx + eax*8 - 0x3d]
sti
movsd dword es:[edi], dword [esi]
arpl word [edi + ecx*2 + 0x4707e9ca], dx
mov ebx, 0x227c2989
adc dword [esi + 0x42], edi
stosb byte es:[edi], al
popfd
jne 0x1022d508
cmc
or al, ch
sbb cl, al
jle 0x1022d516
mov ch, byte ss:[0x6e7501d9]
rol ebp, cl
mov dl, 0x34
mov byte [0x999d841], al
invalid
or eax, esi
jecxz 0x1022d476
rcr dword [ecx - 0x3e], cl
adc al, 0x44
sbb eax, 0x6a3c36e0
invalid
outsb dx, byte [esi]
mov dl, 0xcb
mov ebp, 0x3b966deb
imul ebp, dword [ebx + 0x41057b2b], 0x43
inc ebx
jb 0x1022d52b
add edi, dword [ebp + 0x76]
imul edx, dword [esi + 0x6b662a0], 0xe9a96db1
std
cmp eax, 0x23c3c9b9
sbb esp, dword [edx - 0x45]
pop es
mov eax, 0xfc1ec39e
and ebx, dword [ebx]
bound edi, qword [ebx - 0x3c6147f9]
push ds
cld
sbb dl, byte [edx - 5]
insd dword es:[edi], dx
xchg byte [edi], ah
daa
hlt
Function at 0x102303dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x2c]
jne fcn.10235135
movsx si, dl
sbb cl, dl
mov ecx, edi
adc si, bx
stc
cmp ah, 0x17
sub ecx, ebx
clc
bswap si
sub si, 0xf328
mov esi, esp
push eax
sub edi, 4
jmp 0x1023678b
pushal
push dword [edi]
pop dword [esp + 0x20]
pushal
bt ecx, 7
cmp edi, ebx
mov byte [esp], dl
lea esp, [esp + 0x40]
ja 0x1022baaf
clc
sub ebx, edi
xor di, 0x1a5e
sal di, 8
add ebx, esp
mov di, ax
lea edi, [eax*8 + 0x60833d4]
mov edi, ebx
pushal
mov word [esp], 0x7302
mov dword [esp], 0x199c421a
lea esp, [esp + 0x20]
jmp 0x1022c8f0

Function at 0x10232b6c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x28]
ja 0x102371d3
mov ah, bl
add al, 0x20
pushal
mov ah, byte [esi]
clc
call fcn.1023040b
Function at 0x10237692
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
push ebp
pushfd
xor eax, eax
lea esp, [esp + 0x10]

Function at 0x10239e4c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x2c]
ja 0x1022b886
pushal
pushal
push ecx
jmp 0x10234249
pushfd
mov eax, dword [esp + 0x20]
push esp
jmp 0x1022bfdf

Function at 0x10239e57
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x2c]
je 0x10232697
pushfd
mov byte [esp], 0x2d
call fcn.10239208

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40664b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x406685
push 6
call fcn.00471847
add esp, 4
jmp 0x40668a
mov esp, ebp
pop ebp
ret 4

Function at 0x40788d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x200
call fcn.0040664b
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x200
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4078db
push 6
call fcn.00471847
add esp, 4
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x4c6c2f]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.004019e2
push 0x80000301
push 0
push eax
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x910
call fcn.00473720
add esp, 0x1c
mov dword [ebp - 0x1c], eax
push 0x4c6e29
push dword [ebp - 0x1c]
mov ecx, 2
call fcn.00401f92
add esp, 8
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x407947
push ebx
call fcn.00471841
add esp, 4
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
call fcn.0040797d
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x40796f
push ebx
call fcn.00471841
add esp, 4
mov eax, dword [ebp - 0x28]
jmp 0x407977
mov esp, ebp
pop ebp
ret 4

Function at 0x4082b3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0x14]
mov dword [ebx], 0
push VariantClear
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.00473530
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x408322
push 6
call fcn.00471847
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x408356
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x408351
push 6
call fcn.00471847
add esp, 4
jmp 0x40835e
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x40836f
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4346b6
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
call dword [sym.imp.IMM32.dll_ImmGetContext]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4346f6
push 6
call fcn.00471847
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x434827
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.004731b0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 0
push dword [ebp - 0x10]
push 0x800
push dword [ebp - 4]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x434753
push 6
call fcn.00471847
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x434766
push ebx
call fcn.00471841
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x184
call fcn.00473220
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x43479f
push ebx
call fcn.00471841
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x800
push dword [ebp - 4]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4347d0
push 6
call fcn.00471847
add esp, 4
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4347f5
push 6
call fcn.00471847
add esp, 4
lea eax, [ebp - 0xc]
push eax
call fcn.00434849
test eax, eax
je 0x434827
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x434822
push eax
mov ebx, eax
call fcn.00401000
inc eax
push eax
call fcn.0047183b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x434831
mov eax, 0x4972d2
jmp 0x434831
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x434842
push ebx
call fcn.00471841
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x443091
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4430cc
push 6
call fcn.00471847
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00472fc0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44312f
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004731d0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x443153
push 6
call fcn.00471847
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00472fc0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4431b6
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004731d0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4431da
push 6
call fcn.00471847
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00472fc0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44323d
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004731d0
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x443245
mov esp, ebp
pop ebp
ret

Function at 0x4723d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x472439
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.00471cb0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret