joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cda55
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4cdb6d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4cdb6d
mov eax, dword [esi + 0x3c]
push eax
call fcn.00506988
mov esi, eax
test esi, esi
je 0x4cdb6d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4cdb6d
mov ecx, esi
call fcn.004cd9c0
cmp edi, eax
jge 0x4cdb6d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4cdaf3
mov dword [esp + 0x34], 1
jmp 0x4cdb4e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4cdb6d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004ccf50
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x4d8710
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x4d875c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x4d875c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x4d8746
push eax
call ebp
test ax, ax
jl 0x4d8754
inc esi
add edi, 4
cmp esi, 6
jb 0x4d8738
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.004d8410
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4dc580
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x4dc5e0
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x4dc5e0
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x4dc5e0
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x4dc5e0
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x4dc5f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x4e0910
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4e0976
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4e0976
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4e0957
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4e10f0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4e1128
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x4e1d50
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4e1d99
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4e2210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x515200
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004e1dc0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004e1e40
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004e1e40
lea ecx, [esi + 0xc]
call fcn.00504ee8
lea ecx, [esi + 0x10]
call fcn.00504ee8
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004e33d0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004e33d0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004e33d0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00504f5d
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00504f5d
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4e78c0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4e790a
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x4e7939
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x4e797b
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x50732b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x507363
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005053b8
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00505390
jmp 0x50736f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x508a1c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x508a5e
call fcn.0050ea64
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x508a5e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x508a55
xor eax, eax
jmp 0x508a66
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00508a6c
pop edi
pop esi
pop ebx
ret 4

Function at 0x50ef94
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x50efc2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x50efe0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0050eefa
jmp 0x50efe0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x50efe0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0050eefa
test edi, edi
mov eax, edi
jne 0x50efca
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4195d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x457df7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x46a7b4]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x34]
mov bl, 2
push 0x46e1f8
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], bl
call fcn.0044e896
test esi, esi
je 0x4196ad
push ebp
mov ebp, dword [0x45a4d4]
lea eax, [esp + 0x38]
push esi
push eax
mov ecx, edi
call fcn.004497f0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 3
call fcn.0044e846
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], bl
call fcn.0044e74a
push 0x469328
lea ecx, [esp + 0x18]
call fcn.0044eaf0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.0044e93e
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 4
call fcn.0044e846
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call fcn.0044e74a
mov ecx, dword [edi + 0x1c]
push esi
push 3
push 0x110a
push ecx
call ebp
mov esi, eax
test esi, esi
jne 0x419631
pop ebp
push 1
push 0x5c
lea ecx, [esp + 0x1c]
call fcn.0044861b
lea edx, [esp + 0x18]
push 1
push edx
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 5
call fcn.00448806
mov ecx, dword [esp + 0x14]
mov edx, dword [eax]
push ecx
push edx
call fcn.00437e3b
add esp, 8
lea ecx, [esp + 0x18]
test eax, eax
sete byte [esp + 0x34]
call fcn.0044e74a
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.0044e74a
mov al, byte [esp + 0x34]
test al, al
je 0x419737
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x34]
mov eax, dword [eax - 8]
dec eax
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.00448882
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 6
call fcn.0044e846
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], bl
call fcn.0044e74a
mov esi, dword [esp + 0x30]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.0044e4b7
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.0044e74a
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.0044e74a
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x41aa10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x100
mov al, byte [esp + 0x104]
push ebx
mov byte [esp + 5], al
mov ebx, ecx
not al
mov byte [esp + 6], al
mov eax, dword [esp + 0x110]
mov ecx, eax
push esi
shr ecx, 8
test eax, eax
mov byte [esp + 8], 0x40
mov byte [esp + 0xb], al
mov byte [esp + 0xc], cl
jbe 0x41aa65
mov esi, dword [esp + 0x118]
mov ecx, eax
mov edx, ecx
push edi
lea edi, [esp + 0x11]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov ecx, dword [esp + 0x110]
test ecx, ecx
je 0x41aaac
mov dl, byte [esp + 8]
mov ecx, 1
lea esi, [eax + 5]
cmp esi, ecx
jbe 0x41aa89
xor dl, byte [esp + ecx + 8]
inc ecx
cmp ecx, esi
jb 0x41aa80
mov byte [esp + eax + 0xd], dl
push 0
add eax, 6
push 0
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.00415790
pop esi
pop ebx
add esp, 0x100
ret 0x10
push 0
add eax, 5
push 0
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, ebx
call fcn.00415790
pop esi
pop ebx
add esp, 0x100
ret 0x10

Function at 0x41ad50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x457f4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 0x90]
call fcn.0041c250
xor ebx, ebx
lea ecx, [esi + 0x60bc]
mov dword [esp + 0x14], ebx
call fcn.0041c110
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x45cc70
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x24], ebx
mov byte [esi + 0x60b8], bl
mov dword [esi + 4], ebx
mov dword [esi + 0x84], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4203d0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x45813b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x104
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x10], ebx
mov al, byte [esp + 0x124]
xor ebp, ebp
mov byte [esp + 0x15], al
mov dword [esp + 0x11c], ebp
not al
mov byte [esp + 0x16], al
mov eax, dword [esp + 0x12c]
mov ecx, eax
mov dword [ebx], 0x45ccdc
shr ecx, 8
cmp eax, ebp
mov dword [ebx + 4], ebp
mov dword [ebx + 8], ebp
mov dword [ebx + 0xc], ebp
mov dword [ebx + 0x10], ebp
mov byte [esp + 0x14], 0x40
mov byte [esp + 0x17], al
mov byte [esp + 0x18], cl
jbe 0x420459
mov esi, dword [esp + 0x130]
mov ecx, eax
mov edx, ecx
lea edi, [esp + 0x19]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x128], ebp
je 0x4204a1
mov cl, byte [esp + 0x14]
mov edx, 1
lea esi, [eax + 5]
cmp esi, edx
jbe 0x42047b
xor cl, byte [esp + edx + 0x14]
inc edx
cmp edx, esi
jb 0x420472
lea ebp, [eax + 6]
mov byte [esp + eax + 0x19], cl
push ebp
call fcn.0044ec96
mov ecx, ebp
mov dword [ebx + 4], eax
mov edi, eax
mov eax, ecx
add esp, 4
lea esi, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x4204c1
lea ebp, [eax + 5]
push ebp
call fcn.0044ec96
mov ecx, ebp
add esp, 4
mov edx, ecx
lea esi, [esp + 0x14]
mov edi, eax
mov dword [ebx + 4], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x114]
pop edi
mov dword [ebx + 8], ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x110
ret 0x10
Function at 0x423be0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4585a4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov eax, dword [0x46a7b4]
lea ecx, [esi + 4]
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov dword [ecx], eax
mov edx, dword [0x46a7b4]
lea edi, [esi + 0x38]
mov dword [edi], edx
mov eax, dword [0x46a7b4]
lea ebp, [esi + 0x3c]
mov dword [ebp], eax
mov edx, dword [0x46a7b4]
mov dword [esi + 0x40], edx
push 0x46a4c8
mov byte [esp + 0x24], 4
mov dword [esi], 0x45cfa0
call fcn.0044e8bd
mov dword [esi + 8], 0x40000000
mov dword [esi + 0x10], 0x96748904
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
push 0x46a4c4
mov ecx, edi
mov dword [esi + 0xc], 0x415854a6
mov dword [esi + 0x14], 0x4072a41d
mov dword [esi + 0x2c], 0x3ff00000
mov dword [esi + 0x34], ebx
call fcn.0044e8bd
push 0x46a4c4
mov ecx, ebp
call fcn.0044e8bd
push 0x46a4c0
lea ecx, [esi + 0x40]
call fcn.0044e8bd
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], 0x411e8480
mov byte [esi + 0x44], bl
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb4], 0x3ff00000
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xc8], ebx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xdc], ebx
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x424a10
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor al, al
xor ecx, ecx
test edx, edx
jle 0x424a2e
push ebx
push esi
mov esi, dword [esp + 0xc]
mov bl, byte [ecx + esi]
xor al, bl
inc ecx
cmp ecx, edx
jl 0x424a22
pop esi
pop ebx
ret 8
Function at 0x424a40
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi], 0x24
jne 0x424b15
push 0x2a
push edi
call fcn.00438ea0
add esp, 8
test eax, eax
je 0x424b0c
mov cl, byte [eax + 1]
push ebx
cmp cl, 0x61
push esi
jl 0x424a78
cmp cl, 0x7a
jg 0x424a78
movsx edx, cl
lea esi, [edx - 0x20]
jmp 0x424a7d
movsx edx, cl
mov esi, edx
cmp esi, 0x41
jl 0x424a94
cmp cl, 0x61
jl 0x424a8f
cmp cl, 0x7a
jg 0x424a8f
add edx, 0xffffffe0
lea ebx, [edx - 0x37]
jmp 0x424aa4
cmp cl, 0x61
jl 0x424aa1
cmp cl, 0x7a
jg 0x424aa1
add edx, 0xffffffe0
lea ebx, [edx - 0x30]
mov cl, byte [eax + 2]
cmp cl, 0x61
jl 0x424ab9
cmp cl, 0x7a
jg 0x424ab9
movsx edx, cl
lea esi, [edx - 0x20]
jmp 0x424abe
movsx edx, cl
mov esi, edx
cmp esi, 0x41
jl 0x424ad5
cmp cl, 0x61
jl 0x424ad0
cmp cl, 0x7a
jg 0x424ad0
add edx, 0xffffffe0
lea ecx, [edx - 0x37]
jmp 0x424ae5
cmp cl, 0x61
jl 0x424ae2
cmp cl, 0x7a
jg 0x424ae2
add edx, 0xffffffe0
lea ecx, [edx - 0x30]
shl bl, 4
lea edx, [eax - 1]
add bl, cl
cmp edi, edx
mov cl, bl
je 0x424aff
mov eax, edi
mov bl, byte [eax + 1]
xor cl, bl
inc eax
cmp eax, edx
jne 0x424af5
xor eax, eax
pop esi
test cl, cl
pop ebx
pop edi
setne al
ret 4
mov eax, 2
pop edi
ret 4
mov eax, 3
pop edi
ret 4

Function at 0x42a110
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
xor ecx, ecx
test esi, esi
jle 0x42a145
push ebx
push edi
mov edi, dword [esp + 0x10]
xor edx, edx
mov ebx, eax
mov dl, byte [ecx + edi]
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x45d260]
xor eax, edx
inc ecx
cmp ecx, esi
jl 0x42a123
pop edi
pop ebx
pop esi
ret 8

Function at 0x432200
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4588db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x46a7b4]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 0xc]
mov dword [ecx], eax
xor ebx, ebx
push 0x46a4c8
mov dword [esp + 0x1c], ebx
mov dword [esi], 0x45d1c8
mov byte [esi + 8], bl
call fcn.0044e8bd
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x10], 0x40000000
mov dword [esi + 0x18], 0x84f3b8a9
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], 0xf1fe9539
mov dword [esi + 0x30], 0xe2939d71
mov dword [esi + 0x14], 0x415854a6
mov dword [esi + 0x1c], 0x3f6b775a
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], 0x3f7b6b90
mov dword [esi + 0x34], 0x3f7b9adf
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4075b8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040ab4c
test esi, esi
jne 0x4075ee
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040acd4
jmp 0x40760c
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00407498
mov edi, eax
test esi, esi
je 0x40760c
cmp dword [ebx], 0
je 0x40760c
dec esi
jmp 0x4075f5
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x409654
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00409b14
mov byte [esp], al
cmp byte [esp], 0
jne 0x4097dd
test edi, edi
je 0x4097dd
mov byte [esp + 1], 0
test ebp, ebp
jle 0x40971d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4096f8
cmp edi, 0xffffffff
je 0x4096b9
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4096b9
mov byte [esp], 0
jmp 0x4097dd
cmp dword [esi], 1
jg 0x4096f8
cmp dword [esi], 0
jne 0x4096ea
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4096ea
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4097dd
lea eax, [esp + 0xc]
call fcn.00409304
dec ebp
test ebp, ebp
jg 0x40969e
cmp edi, 0xffffffff
je 0x40971d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40971b
mov byte [esp], 0
jmp 0x4097dd
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x409662
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40971d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00409858
mov edx, eax
mov ebx, dword [0x8098fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x409781
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x40977f
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x409781
xor edi, edi
cmp byte [esp], 0
je 0x4097a7
mov ebx, dword [esi]
test bl, 1
jne 0x4097bd
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409787
mov byte [esp + 1], 1
jmp 0x4097bd
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4097a7
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x409734
cmp byte [esp], 0
je 0x4097dd
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40a7a8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x80905c], 0
je 0x40a80f
cmp word [0x809348], 0xd7b2
jne 0x40a7d1
cmp dword [0x809350], 0
jbe 0x40a7d1
mov eax, 0x809344
call dword [0x809360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40a83c
call fcn.0040b544
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x7eb036], 0
jne 0x40a82b
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x40aa0c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x7eb038], 0
je 0x40aa37
mov edx, edi
mov eax, esi
call dword [0x7eb038]
mov ebx, eax
jmp 0x40aa48
mov eax, 8
call fcn.004071c4
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x80905d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40a9d4
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40aa78
mov eax, ebx
call fcn.004071e0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc