joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f6530
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528607
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x57146c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x4f657a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f6586
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.004503e0
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x4f65f3
push 0x48
call fcn.0042d7c0
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x4f65e7
push 0x48
push 0
push ebx
call fcn.004a7120
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.004f4f40
jmp 0x4f65e9
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f6620
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.004503e0
push 3
push 0x55001c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00415b10
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4f666f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x4f66be
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x4f66be
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push 0x550024
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.004503e0
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.00412020
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4f66f4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4f66ea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f6731
push edx
push ecx
call fcn.00477d79
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x4f6713
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477d68
mov esp, ebp
pop ebp
ret 0x14
call fcn.004c23c3
int3
Function at 0x4f85e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5288a8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x57146c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0042d7c0
mov edi, eax
add esp, 4
test edi, edi
je 0x4f8683
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004fddf3
add esp, 4
mov dword [edi + 4], eax
jmp 0x4f8685
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.004841f0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x4f86e5
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x4f86e5
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x4f8709
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x4f872b
cmp byte [ebp + 0xc], 0
je 0x4f8718
push esi
call fcn.004fe0ab
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x4f8737
mov esi, 0x53f064
jmp 0x4f8747
test cl, 2
mov esi, 0x53f07c
mov eax, 0x53f094
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.0045ee40
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.0045ab70
push 0x5629fc
lea eax, [ebp - 0x30]
push eax
call fcn.004a731c
int3
Function at 0x4fac80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.004fb290
add esp, 8
test al, al
je 0x4faca5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4faca5
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x4fb290
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x4fc740
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4fc76b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4fc76b
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
lea ecx, [esi + 2]
sub esi, eax
mov edi, 4
mov edi, edi
movzx edx, byte [esi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x401010
pop edi
pop esi
ret

Function at 0x401040
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add eax, 1
mov ecx, 4
jmp 0x401050
movzx edx, byte [eax - 1]
movzx edx, byte [edx + str.cw]
mov byte [eax - 1], dl
movzx edx, byte [eax]
movzx edx, byte [edx + str.cw]
mov byte [eax], dl
movzx edx, byte [eax + 1]
movzx edx, byte [edx + str.cw]
mov byte [eax + 1], dl
movzx edx, byte [eax + 2]
movzx edx, byte [edx + str.cw]
mov byte [eax + 2], dl
add eax, 4
sub ecx, 1
jne 0x401050
ret

Function at 0x401140
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x14
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov dword [eax], esi
mov esi, dword [ecx + 4]
mov dword [eax + 4], esi
mov esi, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov edx, 2
lea ecx, [eax + 0x10]
push edi
mov dword [eax + 8], esi
mov byte [esp + 0x14], 1
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 4
mov byte [esp + 0x17], 8
mov byte [esp + 0x18], 0x10
mov byte [esp + 0x19], 0x20
mov byte [esp + 0x1a], 0x40
mov byte [esp + 0x1b], 0x80
mov byte [esp + 0x1c], 0x1b
mov byte [esp + 0x1d], 0x36
lea edi, [esp + 0x14]
mov eax, ecx
mov ebx, 0xfffffffd
mov dword [esp + 0x10], edx
mov ebp, 0xa
lea esp, [esp]
movzx edx, byte [ebx + eax]
movzx edx, byte [edx + str.cw]
xor dl, byte [edi]
mov esi, 1
mov byte [eax], dl
mov edx, 0xfffffffe
movzx edx, byte [edx + eax]
movzx edx, byte [edx + str.cw]
mov byte [esi + eax], dl
mov esi, dword [esp + 0x10]
or edx, 0xffffffff
movzx edx, byte [edx + eax]
movzx edx, byte [edx + str.cw]
mov byte [esi + eax], dl
mov edx, 0xfffffffc
movzx edx, byte [edx + eax]
movzx edx, byte [edx + str.cw]
mov esi, 3
mov byte [esi + eax], dl
mov edx, dword [eax - 0x10]
xor dword [ecx], edx
mov esi, dword [ecx]
mov edx, dword [eax - 0xc]
xor edx, esi
mov esi, dword [eax - 8]
xor esi, edx
mov dword [eax + 4], edx
mov edx, dword [eax - 4]
xor edx, esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], edx
add edi, 1
add ecx, 0x10
add eax, 0x10
sub ebp, 1
jne 0x4011c0
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00403a8e
add esp, 0x14
ret
Function at 0x401260
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, eax
mov ecx, esi
mov eax, edi
call fcn.00401000
add esi, 0x11
mov ebx, 1
lea ebp, [edi + 1]
mov dword [esp + 0xc], esi
mov edi, edi
mov eax, edi
call fcn.00401040
cmp ebx, 0xa
movzx ecx, byte [edi + 5]
movzx edx, byte [edi + 9]
mov al, byte [ebp]
mov byte [ebp], cl
movzx ecx, byte [edi + 0xd]
mov byte [edi + 5], dl
movzx edx, byte [edi + 0xa]
mov byte [edi + 0xd], al
mov al, byte [edi + 2]
mov byte [edi + 9], cl
movzx ecx, byte [edi + 0xe]
mov byte [edi + 2], dl
movzx edx, byte [edi + 0xb]
mov byte [edi + 0xa], al
mov al, byte [edi + 6]
mov byte [edi + 0xe], al
mov al, byte [edi + 0xf]
mov byte [edi + 6], cl
movzx ecx, byte [edi + 7]
mov byte [edi + 0xf], dl
movzx edx, byte [edi + 3]
mov byte [edi + 0xb], cl
mov byte [edi + 7], dl
mov byte [edi + 3], al
je 0x4012fb
mov esi, edi
call fcn.00401090
lea esi, [edi + 4]
call fcn.00401090
lea esi, [edi + 8]
call fcn.00401090
lea esi, [edi + 0xc]
call fcn.00401090
mov ecx, dword [esp + 0xc]
mov eax, ebp
mov esi, 4
movzx edx, byte [ecx - 1]
xor byte [eax - 1], dl
movzx edx, byte [ecx]
xor byte [eax], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx + 2]
xor byte [eax + 2], dl
add ecx, 4
add eax, 4
sub esi, 1
jne 0x401306
add ebx, 1
cmp ebx, 0xa
mov dword [esp + 0xc], ecx
jle 0x401280
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x401340
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0x2d4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2d0], eax
mov eax, dword [esp + 0x2dc]
mov edx, dword [eax + 4]
push ebx
push ebp
mov dword [esp + 0x2cc], edx
mov edx, dword [eax + 8]
push esi
mov esi, ecx
mov ecx, dword [eax]
mov dword [esp + 0x2d4], edx
mov edx, dword [eax + 0xc]
mov dword [esi], ecx
mov dword [esp + 0x2cc], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov dword [esp + 0x2d8], edx
mov edx, dword [eax + 8]
lea ecx, [esp + 0xc]
push edi
mov dword [esi + 8], edx
mov eax, dword [eax + 0xc]
push ecx
mov ecx, dword [esp + 0x2ec]
mov dword [esi + 0xc], eax
call fcn.00401140
add esp, 4
lea eax, [esp + 0x10]
lea edi, [esp + 0x2d0]
call fcn.00401260
mov ecx, edi
lea edi, [esp + 0x2d1]
lea ebp, [esp + 0x2d2]
sub ecx, esi
sub edi, esi
sub ebp, esi
lea edx, [esp + 0x2d3]
mov eax, esi
sub edx, esi
mov esi, 4
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [edi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [eax + ebp]
xor byte [eax + 2], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 3], bl
add eax, 4
sub esi, 1
jne 0x4013e6
mov ecx, dword [esp + 0x2e0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00403a8e
add esp, 0x2d4
ret
Function at 0x401ad0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x234
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x230], eax
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 4], esi
je 0x401b1c
call fcn.00401600
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x401b34
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.00403a8e
add esp, 0x234
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esp, [esp]
mov ecx, str.WinDVD.exe
lea eax, [esp + 0x38]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401b86
test dx, dx
je 0x401b82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401b86
add eax, 4
add ecx, 4
test dx, dx
jne 0x401b60
xor eax, eax
jmp 0x401b8b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401bb5
mov ecx, dword [esp + 0x1c]
push ecx
push eax
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401be5
push esi
call ebx
push 0
push esi
call ebp
push esi
call edi
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401b50
push esi
call edi
mov eax, 1
mov ecx, dword [esp + 0x240]
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.00403a8e
add esp, 0x234
ret
xor eax, eax
jmp 0x401bcc

Function at 0x401bf0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x401c38
call fcn.00401600
lea eax, [esp + 4]
push eax
push esi
mov dword [esp + 0xc], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x401c50
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00403a8e
add esp, 0x230
ret
push ebx
mov ebx, dword [sym.imp.MSVCR80.dll__wcsicmp]
lea ecx, [esp + 0x2c]
push edi
push ecx
call ebx
add esp, 8
test eax, eax
je 0x401c95
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401c57
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00403a8e
add esp, 0x230
ret
mov ecx, dword [esp + 0x234]
pop ebx
pop esi
xor ecx, esp
mov eax, 1
call fcn.00403a8e
add esp, 0x230
ret
Function at 0x403250
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0xc
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 8], eax
push esi
mov esi, ecx
xor ecx, ecx
mov eax, 0x40661d
jmp 0x403270
movzx edx, byte [eax - 1]
mov byte [esp + ecx + 4], dl
movzx edx, byte [eax]
mov byte [esp + ecx + 5], dl
movzx edx, byte [eax + 1]
mov byte [esp + ecx + 6], dl
movzx edx, byte [eax + 2]
mov byte [esp + ecx + 7], dl
add ecx, 4
add eax, 4
cmp ecx, 8
jb 0x403270
mov ecx, dword [0x40661c]
shr ecx, 3
and ecx, 0x3f
cmp ecx, 0x38
mov eax, 0x38
jb 0x4032b5
mov eax, 0x78
sub eax, ecx
push 0x406678
call fcn.00403190
lea eax, [esp + 8]
push eax
mov eax, 8
call fcn.00403190
lea ecx, [esi + 1]
add esp, 8
mov eax, 0x406625
mov esi, 4
movzx edx, byte [eax - 1]
mov byte [ecx - 1], dl
movzx edx, byte [eax]
mov byte [ecx], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 2]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub esi, 1
jne 0x4032e0
xor eax, eax
push 0x40
push eax
push 0x406638
mov dword [0x406624], eax
mov dword [0x406628], eax
mov dword [0x40662c], eax
mov dword [0x406630], eax
mov dword [0x40661c], eax
mov dword [0x406620], eax
call sub.MSVCR80.dll_memset
push 0x40
push 0
push 0x406678
mov dword [0x406620], 0
mov dword [0x40661c], 0
mov dword [0x406624], 0x67452301
mov dword [0x406628], 0xefcdab89
mov dword [0x40662c], 0x98badcfe
mov dword [0x406630], 0x10325476
call sub.MSVCR80.dll_memset
mov ecx, dword [esp + 0x24]
add esp, 0x18
pop esi
xor ecx, esp
mov byte [0x406678], 0x80
call fcn.00403a8e
add esp, 0xc
ret

Function at 0x403a8e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x403a98
repz ret
jmp fcn.00403dc0
Function at 0xa73040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
test eax, eax
jle 0xa7309b
push edi
mov edi, dword [ebp + 0x10]
sub dword [ebp + 0xc], edi
mov dword [ebp + 8], eax
mov edi, edi
inc bl
lea edi, [edi + 1]
movzx ebx, bl
mov dl, byte [esi + ebx + 8]
add cl, dl
movzx ecx, cl
mov al, byte [esi + ecx + 8]
mov byte [esi + ebx + 8], al
add al, dl
movzx eax, al
mov byte [esi + ecx + 8], dl
movzx edx, byte [eax + esi + 8]
mov eax, dword [ebp + 0xc]
xor dl, byte [eax + edi - 1]
sub dword [ebp + 8], 1
mov byte [edi - 1], dl
jne 0xa73060
mov eax, dword [ebp + 0x14]
pop edi
mov dword [esi], ebx
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x10004377
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10004386
pop dword [ebp - 0x28]
mov eax, 0x10004386
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x2a06b2de
sub dword [ebp - 0x38], 0xdbb46d93
mov dword [ebp - 0x34], 0xfb55357b
add dword [ebp - 0x34], 0x36de16ca
mov dword [ebp - 0x30], 0xf35b4c3f
sub dword [ebp - 0x30], 0xa70f0811
mov dword [ebp - 0x2c], 0xe021719a
add dword [ebp - 0x2c], 0x1fde8e66
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xe1b2b546
add dword [ebp - 0x38], 0x92bfb410
mov dword [ebp - 0x34], 0xc6e0c463
add dword [ebp - 0x34], 0x7a8b9d12
mov dword [ebp - 0x30], 0x4436b501
add dword [ebp - 0x30], 0x1f38b76b
mov dword [ebp - 0x2c], 0x3e137834
sub dword [ebp - 0x2c], 0x3e137834
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x38834
push 0
call eax
mov ecx, 0xb2f8328f
sub ecx, 0xb2f7e2b4
mov edi, eax
mov ebx, 0xc4e386ab
add ebx, 0x4b1d2155
add ebx, dword [ebp - 0x28]
mov edx, 0xa377abac
add edx, 0x8032a74b
xor dword [ebp - 0xc], ebx
mov esi, dword [ebx]
add dword [ebp - 0x10], 0x2b16bd0
xor esi, edx
add dword [ebp - 0x10], 0x42c7d1f3
mov dword [edi], esi
add edi, 0xa1954255
add edi, 0x5e6abdaf
add ebx, 0xa7548024
sub ebx, 0xa7548020
loop 0x10004499
add eax, 0x777aeaa3
sub eax, 0x7779b864
xor ebx, ebx
add ebx, eax
add eax, 0xf90fed76
add eax, 0x6f0128f
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x559b3896
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x10c33446
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x409141
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
push eax
push dword [esp + 0xc]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x40915d
mov dword [esp], 1
jmp 0x40916d
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x40927f
mov ebx, dword [esp + 0x10]
cmp ebx, 1
je 0x40919f
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x40918f
mov dword [esp], 1
jmp 0x40919f
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x40927f
mov ebx, dword [esp + 0x14]
cmp ebx, 1
je 0x4091d1
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x4091c1
mov dword [esp], 1
jmp 0x4091d1
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x40927f
mov ebx, dword [esp + 0x18]
cmp ebx, 1
je 0x409200
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x4091f3
mov dword [esp], 1
jmp 0x409200
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x40927f
mov ebx, dword [esp + 0x10]
cmp ebx, 1
jne 0x409226
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x409226
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x40927f
mov ebx, dword [esp + 0x14]
cmp ebx, 1
jne 0x40924c
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x40924c
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x40927f
mov ebx, dword [esp + 0x18]
cmp ebx, 1
jne 0x409272
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x409272
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x40927f
xor edx, edx
mov eax, 1
jmp 0x40927f
add esp, 4
pop ebx
ret 0x10

Function at 0x40b98c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x40ba70
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test byte [ebp + 0x10], 1
mov ebx, eax
je 0x40ba26
push edi
push edi
push edi
push dword [ebp + 0xc]
call fcn.0040c4d5
mov ebx, eax
cmp ebx, edi
je 0x40ba65
push dword [ebp + 8]
push dword [0x499994]
call fcn.00412ac3
mov esi, eax
mov eax, 0x10000
push eax
push ebx
mov dword [esi + 0x18], eax
call fcn.0040c478
push eax
push ebx
call fcn.0040c45e
push eax
call fcn.0040c0b9
cmp eax, edi
mov dword [esi], eax
je 0x40ba1e
mov dword [esi + 0x14], ebx
mov dword [ebp - 4], esi
jmp 0x40ba65
push ebx
call fcn.0040c485
jmp 0x40ba65
push ebx
push edi
push dword [0x49923c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
je 0x40ba65
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push esi
push dword [ebp + 8]
call fcn.0040c0a3
push esi
push edi
push dword [0x49923c]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
leave
ret 0xc