joyce8/EMBER2024-capa huggingface dataset:
Function at 0x522da4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x522f15
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x522ef0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404e40
lea eax, [ebp - 0x118]
mov edx, 0x522f2c
call fcn.00404f30
mov eax, dword [ebp - 0x118]
call fcn.00405120
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x522e62
lea eax, [ebp - 0x111]
call fcn.0040b090
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00404d50
jmp 0x522e69
mov eax, esi
call fcn.00404c60
cmp bl, 0x61
jae 0x522e8a
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040f908
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404cb4
jmp 0x522ea4
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040f87c
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404cb4
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x522f38
call fcn.0040b84c
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522ef7
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x52980b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x74ac16
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x529863
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x74ac37
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x529859
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x529867
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x53aa90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405110
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x53abf3
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0053a954
mov ebx, eax
mov dword [esi], 0x128
mov edx, esi
mov eax, ebx
call fcn.0053a974
jmp 0x53abc5
lea eax, [ebp - 0x138]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404ed8
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040ade4
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409bc8
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409bc8
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.0040506c
je 0x53aba7
lea eax, [ebp - 0x144]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404ed8
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409bc8
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409bc8
mov edx, dword [ebp - 0x148]
pop eax
call fcn.0040506c
jne 0x53abbc
push 0
mov eax, dword [esi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, esi
mov eax, ebx
call fcn.0053a994
test eax, eax
jne 0x53ab08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53abfa
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404c84
lea eax, [ebp - 4]
call fcn.00404c60
ret
Function at 0x53b53c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004033c4
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 0x41
mov word [ebp - 0x18], di
push ebx
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x53b59b
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x53b5a0
call sub.kernel32.dll_GetLastError_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x53b634
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov ebx, edx
mov ebp, eax
mov eax, ebp
call fcn.00404f28
mov ecx, eax
mov eax, dword [esp]
xor edx, edx
call fcn.00404d50
movzx esi, bx
mov eax, ebp
call fcn.00404f28
mov edi, eax
test edi, edi
jle 0x53b69b
mov ebx, 1
mov eax, dword [esp]
call fcn.00405178
mov dl, byte [ebp + ebx - 1]
mov ecx, esi
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, ebx
add eax, eax
inc eax
mov edx, esi
add al, dl
and eax, 0xff
imul eax, eax, 0x77f
add eax, 0x2396
mov esi, eax
inc ebx
dec edi
jne 0x53b668
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x53b6a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x53b735
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404f28
mov ecx, eax
mov eax, edi
xor edx, edx
call fcn.00404d50
mov dword [ebp - 8], 0xff
mov eax, dword [ebp - 4]
call fcn.00404f28
mov esi, eax
test esi, esi
jle 0x53b70b
mov ebx, 1
mov eax, edi
call fcn.00405178
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor dl, byte [ebp - 8]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x53b6f2
lea edx, [ebp - 0xc]
mov eax, dword [edi]
call fcn.0053b14c
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53b73c
lea eax, [ebp - 0xc]
call fcn.00404c60
ret

Function at 0x53b744
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x53b7ca
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0053b268
mov eax, dword [ebp - 8]
call fcn.00404f28
mov ecx, eax
mov eax, edi
xor edx, edx
call fcn.00404d50
mov dword [ebp - 4], 0xff
mov eax, dword [ebp - 8]
call fcn.00404f28
mov esi, eax
test esi, esi
jle 0x53b7b4
mov ebx, 1
mov eax, edi
call fcn.00405178
mov edx, dword [ebp - 8]
mov dl, byte [edx + ebx - 1]
xor dl, byte [ebp - 4]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x53b79b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53b7d1
lea eax, [ebp - 8]
call fcn.00404c60
ret
Function at 0x53b7d8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.0040b2d0
add esp, 0x108
pop ebx
ret
Function at 0x5401dc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405110
xor eax, eax
push ebp
push 0x540240
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.00540318
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040b2d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x540247
lea eax, [ebp - 4]
call fcn.00404c60
ret

Function at 0x54024c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405110
xor eax, eax
push ebp
push 0x5402b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0
push 0x5402bc
lea eax, [ebp - 4]
call fcn.00540318
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.005400b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5402b7
lea eax, [ebp - 4]
call fcn.00404c60
ret

Function at 0x540ba4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405110
xor eax, eax
push ebp
push 0x540c94
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.0053fbc8
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ade4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005414a0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040aca8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00541514
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x540c9b
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c84
ret
Function at 0x540ca4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405110
xor eax, eax
push ebp
push 0x540da4
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.0053fbc8
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
cmp dword [ebp - 4], 0
je 0x540d6a
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ade4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005414a0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040aca8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00541514
jmp 0x540d7c
xor edx, edx
mov eax, ebx
call fcn.005414a0
xor edx, edx
mov eax, ebx
call fcn.00541514
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x540dab
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c84
ret

Function at 0x547418
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x174]
mov edx, ebx
mov eax, edi
call fcn.0054763c
mov esi, eax
mov dword [edi + 0x174], esi
and esi, 0xff
add dword [edi + 0x178], esi
imul esi, dword [edi + 0x178], 0x8088405
inc esi
mov dword [edi + 0x178], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x17c]
mov eax, edi
call fcn.0054763c
mov dword [edi + 0x17c], eax
pop edi
pop esi
pop ebx
ret

Function at 0x54748c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x5474b1
inc esi
mov eax, edi
call fcn.00547470
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.00547418
inc ebx
dec esi
jne 0x54749b
pop edi
pop esi
pop ebx
ret
Function at 0x547540
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405110
xor eax, eax
push ebp
push 0x5475b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.005474b8
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.00547470
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.00547418
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x547580
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5475bc
lea eax, [ebp - 4]
call fcn.00404c60
ret
Function at 0x54bf98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
add esi, 0xfffffbf4
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5c], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 0x1a58], 0
jne 0x54bfd8
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5c], 1
mov eax, dword [ebp + 8]
mov dword [eax - 0x1a58], 0x10000
mov eax, 0x7fff
mov edx, dword [esi]
mov edx, dword [edx + 0xb94]
mov word [edx + eax*2], 0
mov eax, edx
xor ecx, ecx
mov edx, 0xfffe
call fcn.00408908
mov eax, dword [esi]
mov eax, dword [eax + 0x1b0]
mov ax, word [eax*8 + 0x74b8d6]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a62], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x1b0]
mov ax, word [eax*8 + 0x74b8d4]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a64], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x1b0]
movzx eax, word [eax*8 + 0x74b8d8]
mov edx, dword [ebp + 8]
mov dword [edx - 0x1a68], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x1b0]
mov ax, word [eax*8 + 0x74b8da]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a6a], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x1b0]
cmp eax, 2
jg 0x54c07c
mov eax, dword [esi]
mov eax, dword [eax + 0x26c]
or word [eax + 8], 4
jmp 0x54c08e
cmp eax, 8
jl 0x54c08e
mov eax, dword [esi]
mov eax, dword [eax + 0x26c]
or word [eax + 8], 2
mov eax, dword [ebp + 8]
mov word [eax - 0x10fe], 0
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x1104], edx
mov bx, 0x8000
mov eax, dword [ebp + 8]
lea edi, [eax - 0x420]
mov eax, dword [esi]
mov edx, dword [eax + 0xb8c]
mov ecx, ebx
mov eax, dword [edi + 4]
call dword [edi]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a5a], ax
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0
je 0x54c0e6
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0xffff
jne 0x54c0fe
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a5f], 1
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5a], 0
jmp 0x54c162
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a5f], 0
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0x106
jae 0x54c120
mov eax, dword [ebp + 8]
push eax
call fcn.0054bdc0
pop ecx
mov eax, dword [ebp + 8]
mov word [eax - 0x1a6c], 0
xor ebx, ebx
movzx eax, bx
mov edx, dword [esi]
mov edx, dword [edx + 0xb8c]
movzx eax, byte [edx + eax]
mov edx, dword [ebp + 8]
mov dx, word [edx - 0x1a6c]
shl edx, 5
xor ax, dx
and ax, 0x7fff
mov edx, dword [ebp + 8]
mov word [edx - 0x1a6c], ax
inc ebx
cmp bx, 2
jne 0x54c12e
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x550ef0
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffed0
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0x1c8], 0
je 0x550f14
mov eax, dword [ebx + 0x1c8]
call fcn.0053fdac
test al, al
jne 0x550f2a
push esp
push 0x12d
call sub.kernel32.dll_GetTempPathA
mov edx, esi
mov eax, esp
call fcn.005400b0
jmp 0x550f37
mov eax, esi
mov edx, dword [ebx + 0x1c8]
call fcn.00404cb4
add esp, 0x130
pop esi
pop ebx
ret

Function at 0x553eb4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x553ee2
mov eax, ebx
call fcn.0055496c
cmp dword [ebx + 0x3c], 0
je 0x553edb
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x553f53
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x553f45
cmp dword [ebx + 8], 0
je 0x553f04
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x553f16
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x553f45
cmp dword [ebx + 8], 0
je 0x553ef7
cmp eax, 3
je 0x553f29
dec eax
jne 0x553ef7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x553ef7
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x553ef7
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x553f71
cmp dword [ebx + 0x10], 0xcc
je 0x553f71
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00553f7c
pop ebx
ret
Function at 0x5723e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5724e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x68], 0
je 0x5724c8
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x7c], edx
mov dl, 1
mov eax, dword [0x41d654]
call fcn.00403d60
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x5724b5
inc dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
call fcn.0053ae3c
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x5724ab
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
push 0xff
lea eax, [ebp - 0x10b]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x10b]
call fcn.0040b2d0
mov edx, dword [ebp - 0x110]
mov eax, dword [0x74c39c]
call fcn.0040506c
jne 0x5724a7
mov eax, dword [ebp - 4]
mov dword [eax + 0x7c], ebx
jmp 0x5724ab
inc edi
dec esi
jne 0x57245e
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
cmp dword [eax + 0x7c], 0
jne 0x5724c8
cmp dword [ebp - 8], 0x64
jl 0x572433
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5724e8
lea eax, [ebp - 0x110]
call fcn.00404c60
ret
Function at 0x580398
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x5803e9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x5803d0
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x5803c0
jmp 0x5803e9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x5803d1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x58ba7c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x7550f0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x58ba9e
shr eax, 1
xor eax, 0xedb88320
jmp 0x58baa0
shr eax, 1
dec edx
jne 0x58ba8c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x58ba85
mov dword [0x74e594], 1
pop esi
pop ebx
ret

Function at 0x58bac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [0x74e594]
test al, al
jne 0x58bade
call fcn.0058ba7c
mov eax, 4
lea edx, [ebp - 8]
xor ebx, ebx
mov bl, byte [edx]
mov ecx, dword [ebp - 4]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x7550f0]
shr ecx, 8
xor ebx, ecx
mov dword [ebp - 4], ebx
inc edx
dec eax
jne 0x58bae6
mov edx, dword [ebp + 8]
dec edx
test edx, edx
jl 0x58bb36
inc edx
xor eax, eax
xor ebx, ebx
mov bl, byte [esi + eax]
mov ecx, dword [ebp - 4]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x7550f0]
shr ecx, 8
xor ebx, ecx
mov dword [ebp - 4], ebx
inc eax
dec edx
jne 0x58bb13
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x5c8ff4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
test dl, dl
je 0x5c9005
add esp, 0xfffffff0
call fcn.004040f4
mov ebx, edx
mov esi, eax
cmp byte [ebp + 8], 0
je 0x5c901d
cmp word [ecx], 0x25ff
jne 0x5c901d
add ecx, 2
mov eax, dword [ecx]
mov ecx, dword [eax]
mov dword [esi + 0x14], ecx
mov eax, dword [ebp + 0xc]
sub eax, ecx
sub eax, 5
mov byte [esi + 8], 0xe9
mov edx, eax
and dl, 0xff
mov byte [esi + 9], dl
mov edx, eax
shr edx, 8
and dl, 0xff
mov byte [esi + 0xa], dl
mov edx, eax
shr edx, 0x10
and dl, 0xff
mov byte [esi + 0xb], dl
shr eax, 0x18
and al, 0xff
mov byte [esi + 0xc], al
mov eax, dword [esi + 0x14]
mov al, byte [eax]
mov byte [esi + 0xd], al
mov eax, dword [esi + 0x14]
mov al, byte [eax + 1]
mov byte [esi + 0xe], al
mov eax, dword [esi + 0x14]
mov al, byte [eax + 2]
mov byte [esi + 0xf], al
mov eax, dword [esi + 0x14]
mov al, byte [eax + 3]
mov byte [esi + 0x10], al
mov eax, dword [esi + 0x14]
mov al, byte [eax + 4]
mov byte [esi + 0x11], al
lea eax, [esi + 4]
push eax
push 0x40
push 5
mov eax, dword [esi + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x5c9098
call fcn.004101b0
mov eax, esi
call fcn.005c9128
mov eax, esi
test bl, bl
je 0x5c90b4
call fcn.0040414c
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x5cb93c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0
jne 0x5cb96a
mov ecx, 4
mov dl, 1
mov eax, dword [0x5ca4bc]
call fcn.005ce9fc
call fcn.00404620
mov eax, dword [ebx]
mov byte [eax + 0x14], 1
mov eax, dword [ebx]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x5cb999
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x5cb999
xor eax, eax
jmp 0x5cb99b
mov al, 1
test al, al
jne 0x5cb9bb
call sub.kernel32.dll_GetLastError_1
push eax
mov ecx, 3
mov dl, 1
mov eax, dword [0x5ca4bc]
call fcn.005ce8fc
call fcn.00404620
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x60d868
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.0046de10
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret