joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fdc4c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push edi
push esi
push ebp
push ebx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x4fdcab
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4fdc78
pop ebx
pop ebp
pop esi
pop edi
ret
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4fdcb0
mov edi, eax
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop ebp
pop esi
pop edi
ret
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x4fdca5
Function at 0x4fe14c
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x10
mov ebx, ecx
mov al, byte [ebx + 0xa4]
test al, al
je 0x4fe2ba
mov byte [ebx + 0xa4], 0
mov eax, dword [ebx + 0x34]
test eax, eax
jne 0x4fe178
lea eax, [esp + 0xc]
mov dword [ebx + 0x34], eax
lea eax, [ebx + 0x34]
mov ebp, ebx
mov ebx, eax
mov dword [ebp + 0x40], 0x9df780
mov dword [ebp + 0x44], 0x8000
push 4
push ebx
call fcn.0065cf70
mov esi, eax
add esp, 8
cmp esi, 1
je 0x4fe1ac
test esi, esi
je 0x4fe1ac
mov eax, ebx
mov ebx, ebp
jmp 0x4fe2bd
mov ecx, dword [ebp + 0x44]
neg ecx
lea edi, [ecx + 0x8000]
mov dl, byte [ebp + 0xa6]
test dl, dl
je 0x4fe29d
xor eax, eax
test edi, edi
jle 0x4fe29d
lea edx, [ecx + 0x8000]
cmp edx, 5
jl 0x4fe271
add ecx, 0x7ffb
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
imul edx, dword [ebp + 0xa8], 0xbb38435
add edx, 0x3619636b
mov dword [ebp + 0xa8], edx
xor byte [eax + 0x9df780], dl
imul edx, dword [ebp + 0xa8], 0xbb38435
add edx, 0x3619636b
mov dword [ebp + 0xa8], edx
xor byte [eax + 0x9df781], dl
imul edx, dword [ebp + 0xa8], 0xbb38435
add edx, 0x3619636b
mov dword [ebp + 0xa8], edx
xor byte [eax + 0x9df782], dl
imul edx, dword [ebp + 0xa8], 0xbb38435
add edx, 0x3619636b
mov dword [ebp + 0xa8], edx
xor byte [eax + 0x9df783], dl
add eax, 4
cmp eax, ecx
jle 0x4fe1ef
mov ebx, dword [esp + 8]
mov edi, dword [esp + 4]
mov esi, dword [esp]
imul edx, dword [ebp + 0xa8], 0xbb38435
add edx, 0x3619636b
mov dword [ebp + 0xa8], edx
xor byte [eax + 0x9df780], dl
inc eax
cmp eax, edi
jl 0x4fe271
mov edi, dword [ebp + 0x44]
neg edi
add edi, 0x8000
mov edx, dword [ebp]
mov ecx, ebp
push edi
push 0x9df780
call dword [edx + 0x34]
cmp esi, 1
jne 0x4fe17f
mov eax, ebx
mov ebx, ebp
jmp 0x4fe2bd
lea eax, [ebx + 0x34]
push eax
call fcn.0065d2d0
add ebx, 0x6c
push ebx
call fcn.0065e050
add esp, 0x18
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x4fe7dc
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x18
mov ebx, ecx
mov ebp, dword [esp + 0x30]
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4fe8fc
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
and eax, 0xf
xor eax, edx
sub eax, edx
xor esi, esi
test ebp, ebp
jle 0x4fe8fc
cmp ebp, 5
jl 0x4fe8d9
lea edx, [ebp - 5]
lea edi, [esi + eax]
lea ecx, [eax + esi + 2]
mov dword [esp + 4], edx
lea edx, [eax + esi + 1]
mov ebp, dword [esp + 0x2c]
mov dword [esp + 8], ecx
lea ecx, [eax + esi + 3]
mov dword [esp], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x10]
cdq
xor eax, edx
sub eax, edx
and eax, 0xf
xor eax, edx
sub eax, edx
mov edi, dword [ebx + 0x14]
mov al, byte [eax + edi]
xor byte [esi + ebp], al
mov eax, dword [esp + 0x14]
cdq
xor eax, edx
sub eax, edx
and eax, 0xf
xor eax, edx
sub eax, edx
mov edx, dword [ebx + 0x14]
mov al, byte [eax + edx]
xor byte [esi + ebp + 1], al
mov eax, dword [esp + 8]
cdq
xor eax, edx
sub eax, edx
and eax, 0xf
xor eax, edx
sub eax, edx
mov edx, dword [ebx + 0x14]
mov al, byte [eax + edx]
xor byte [esi + ebp + 2], al
mov eax, dword [esp]
cdq
xor eax, edx
sub eax, edx
and eax, 0xf
xor eax, edx
sub eax, edx
mov edx, dword [ebx + 0x14]
mov al, byte [eax + edx]
xor byte [esi + ebp + 3], al
add esi, 4
mov eax, dword [esp + 4]
add dword [esp + 0x10], 4
add dword [esp + 0x14], 4
add dword [esp + 8], 4
add dword [esp], 4
cmp esi, eax
jle 0x4fe849
mov eax, dword [esp + 0xc]
mov ebp, dword [esp + 0x30]
add eax, esi
mov edi, dword [esp + 0x2c]
mov ecx, eax
cdq
xor ecx, edx
sub ecx, edx
and ecx, 0xf
xor ecx, edx
sub ecx, edx
mov edx, dword [ebx + 0x14]
mov dl, byte [ecx + edx]
xor byte [esi + edi], dl
inc eax
inc esi
cmp esi, ebp
jl 0x4fe8df
add esp, 0x18
pop ebx
pop ebp
pop esi
pop edi
ret 8
Function at 0x500ddc
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x10
mov esi, ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
movzx eax, al
test eax, eax
jne 0x500dff
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov al, byte [esi + 0xa4]
test al, al
je 0x500f56
mov byte [esi + 0xa4], 0
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x500e22
lea eax, [esp + 0xc]
mov dword [esi + 0x34], eax
lea eax, [esi + 0x34]
mov ebp, eax
mov dword [esi + 0x40], 0x9df780
mov dword [esi + 0x44], 0x8000
push 4
push ebp
call fcn.0065cf70
mov ebx, eax
add esp, 8
cmp ebx, 1
je 0x500e4f
test ebx, ebx
jne 0x500f56
mov ecx, dword [esi + 0x44]
neg ecx
lea edi, [ecx + 0x8000]
mov dl, byte [esi + 0xa6]
test dl, dl
je 0x500f40
xor eax, eax
test edi, edi
jle 0x500f40
lea edx, [ecx + 0x8000]
cmp edx, 5
jl 0x500f14
add ecx, 0x7ffb
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], ebp
imul edx, dword [esi + 0xa8], 0xbb38435
add edx, 0x3619636b
mov dword [esi + 0xa8], edx
xor byte [eax + 0x9df780], dl
imul ebx, dword [esi + 0xa8], 0xbb38435
add ebx, 0x3619636b
mov dword [esi + 0xa8], ebx
xor byte [eax + 0x9df781], bl
imul edx, dword [esi + 0xa8], 0xbb38435
add edx, 0x3619636b
mov dword [esi + 0xa8], edx
xor byte [eax + 0x9df782], dl
imul edx, dword [esi + 0xa8], 0xbb38435
add edx, 0x3619636b
mov dword [esi + 0xa8], edx
xor byte [eax + 0x9df783], dl
add eax, 4
cmp eax, ecx
jle 0x500e92
mov edi, dword [esp + 8]
mov ebx, dword [esp + 4]
mov ebp, dword [esp]
imul edx, dword [esi + 0xa8], 0xbb38435
add edx, 0x3619636b
mov dword [esi + 0xa8], edx
xor byte [eax + 0x9df780], dl
inc eax
cmp eax, edi
jl 0x500f14
mov edi, dword [esi + 0x44]
neg edi
add edi, 0x8000
mov edx, dword [esi]
mov ecx, esi
push edi
push 0x9df780
call dword [edx + 0x34]
cmp ebx, 1
jne 0x500e27
mov eax, dword [esi]
mov ecx, esi
push dword [esp + 0x28]
push dword [esp + 0x28]
call dword [eax + 0x34]
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret 8
Function at 0x501084
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8b7d9a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ecx], case.0x4e640c.73
mov dword [ecx + 4], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx], fcn.0043c40c
add ecx, 0x20
call fcn.004e4b6c
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [edx + 4], 1
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], 0xffffffff
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov byte [edx + 0x30], al
mov dword [edx + 0x1c], 2
mov dword [ebp - 4], 0xffffffff
mov dword [edx], fcn.005009b8
xor al, al
mov byte [edx + 0xa6], al
mov byte [edx + 0xa4], al
mov byte [edx + 0xa5], al
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
mov dword [ecx], 0xa0ff98
add ecx, 0xac
push 1
call fcn.0040ae94
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [edx + 0xc0], eax
mov dword [edx + 0xc4], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5014d4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8b7de4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ecx
call fcn.004f7214
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xa10278
xor eax, eax
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ebx + 8], eax
mov dword [esi + 0xc], 0x9ee0a0
mov dword [edi + 0x10], 0x28
mov dword [ecx + 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0x14]
mov byte [edx + 0x1c], al
mov edx, dword [ebp - 0x14]
mov byte [edx + 0x1d], al
add ecx, 0x20
mov edx, dword [ebp - 0x14]
mov byte [edx + 0x1e], al
call fcn.00502fa4
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x30], 0
lea ecx, [eax + 0x28]
call fcn.00501d1c
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x38], eax
mov dword [ebp - 4], 3
mov dword [ebp - 0x1c], 0
push 0x1c
call fcn.00898760
mov dword [ebp - 0x20], eax
add esp, 4
mov dword [ebp - 0x18], eax
test eax, eax
je 0x5015f9
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 4
push dword [ebp - 0x14]
mov ecx, eax
call fcn.0065e780
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov dword [edx + 4], eax
mov dword [ebp - 4], 3
mov dword [ebp - 4], 2
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x5015c1
Function at 0x519708
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dword [0x9d4cb8], 0xffffff80
jne 0x519730
test dword [0x9d4cb8], 0xffffffff
jne 0x519820
call fcn.008a6df8
jmp fcn.00519708
push ebx
mov ebx, esp
and esp, 0xfffffff0
push edi
push esi
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push ebp
mov ecx, esi
call fcn.00487bd0
movzx eax, al
test eax, eax
je 0x519760
inc ebp
cmp ebp, 0x10
jl 0x51973e
mov eax, 0xffffffff
pop ecx
pop ebp
pop esi
pop edi
mov esp, ebx
pop ebx
ret
push 0
mov ecx, esi
push ebp
call fcn.004c638c
movzx eax, al
test eax, eax
jne 0x51977e
mov eax, 0xffffffff
pop ecx
pop ebp
pop esi
pop edi
mov esp, ebx
pop ebx
ret
lea ecx, [esi + 0x3b2c]
mov eax, dword [esi + 0x3b2c]
push ebp
call dword [eax + 0x34]
mov ecx, eax
xor edi, edi
mov eax, 0x20
mov edx, ecx
and edx, 0xf
je 0x5197b7
test dl, 3
jne 0x5197e7
neg edx
add edx, 0x10
shr edx, 2
mov eax, edx
neg eax
add eax, 0x20
cmp eax, 8
jl 0x5197e7
and eax, 7
neg eax
add eax, 0x20
test edx, edx
je 0x5197cf
mov dword [ecx + edi*4], 0
inc edi
cmp edi, edx
jl 0x5197c3
xorps xmm0, xmm0
movaps xmmword [ecx + edi*4], xmm0
movaps xmmword [ecx + edi*4 + 0x10], xmm0
add edi, 8
cmp edi, eax
jl 0x5197d2
cmp edi, 0x20
jge 0x5197f4
mov dword [ecx + edi*4], 0
inc edi
cmp edi, 0x20
jl 0x5197e7
mov byte [ecx + 0x80], 0
mov dword [ecx + 0x84], 0x20
push 0xffffffffffffffff
mov ecx, esi
call fcn.004c04f8
mov ecx, esi
call fcn.004b86b0
mov eax, ebp
pop ecx
pop ebp
pop esi
pop edi
mov esp, ebx
pop ebx
ret
push ebx
mov ebx, esp
and esp, 0xfffffff0
push edi
push esi
sub esp, 8
mov edi, ecx
xor esi, esi
push esi
mov ecx, edi
call fcn.00487bd0
movzx eax, al
test eax, eax
je 0x519852
inc esi
cmp esi, 0x10
jl 0x51982f
mov eax, 0xffffffff
add esp, 8
pop esi
pop edi
mov esp, ebx
pop ebx
ret
push 0
mov ecx, edi
push esi
call fcn.004c638c
movzx eax, al
test eax, eax
jne 0x519871
mov eax, 0xffffffff
add esp, 8
pop esi
pop edi
mov esp, ebx
pop ebx
ret
lea ecx, [edi + 0x3b2c]
mov eax, dword [edi + 0x3b2c]
push esi
call dword [eax + 0x34]
mov dword [eax], 0
mov ecx, edi
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
mov dword [eax + 0x6c], 0
mov dword [eax + 0x70], 0
mov dword [eax + 0x74], 0
mov dword [eax + 0x78], 0
mov dword [eax + 0x7c], 0
mov byte [eax + 0x80], 0
mov dword [eax + 0x84], 0x20
push 0xffffffffffffffff
call fcn.004c04f8
mov ecx, edi
call fcn.004b86b0
mov eax, esi
add esp, 8
pop esi
pop edi
mov esp, ebx
pop ebx
ret
Function at 0x5c2740
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8be606
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
xor edx, edx
mov dword [ebp - 0x14], ecx
mov dword [ecx], 0xa2acd8
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov dword [eax + 8], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.0065c66c
mov eax, dword [ebp - 0x14]
mov dword [eax], 0xa2ace8
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov dword [edx + 0xc], 0xa2acf8
mov byte [ecx + 0x30], 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5d17e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8bfa8e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
add ecx, 0x28
call fcn.0041cbf8
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x2c
call fcn.0041cbf8
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
add ecx, 0x30
call fcn.0041cbf8
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0x34
call fcn.0041cbf8
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
add ecx, 0x38
call fcn.0041cbf8
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x14]
add ecx, 0x3c
call fcn.0041cbf8
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x14]
add ecx, 0x40
call fcn.0041cbf8
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.0041cbf8
mov dword [ebp - 4], 7
mov ecx, dword [ebp - 0x14]
add ecx, 0x48
call fcn.0041cbf8
mov dword [ebp - 4], 8
mov ecx, dword [ebp - 0x14]
add ecx, 0x4c
call fcn.0041cbf8
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x14]
add ecx, 0x50
call fcn.0041cbf8
mov dword [ebp - 4], 0xa
mov ecx, dword [ebp - 0x14]
add ecx, 0x54
call fcn.0041cbf8
mov dword [ebp - 4], 0xb
mov ecx, dword [ebp - 0x14]
add ecx, 0x58
call fcn.0041cbf8
mov dword [ebp - 4], 0xc
mov ecx, dword [ebp - 0x14]
add ecx, 0x5c
call fcn.0041cbf8
mov dword [ebp - 4], 0xd
mov ecx, dword [ebp - 0x14]
add ecx, 0x60
call fcn.0041cbf8
mov dword [ebp - 4], 0xe
mov ecx, dword [ebp - 0x14]
add ecx, 0x64
call fcn.0041cbf8
mov dword [ebp - 4], 0xf
mov ecx, dword [ebp - 0x14]
add ecx, 0x68
call fcn.0041cbf8
mov dword [ebp - 4], 0x10
mov ecx, dword [ebp - 0x14]
add ecx, 0x6c
push 1
call fcn.005d19d8
mov dword [ebp - 4], 0x11
mov ecx, dword [ebp - 0x14]
add ecx, 0x8c
push 1
call fcn.005d19f4
mov dword [ebp - 4], 0x12
mov ecx, dword [ebp - 0x14]
add ecx, 0xac
push 1
call fcn.005d1a10
mov dword [ebp - 4], 0x13
mov ecx, dword [ebp - 0x14]
add ecx, 0xcc
push 1
call fcn.005d1a2c
mov eax, dword [ebp - 0x14]
mov ebx, 4
mov edx, dword [ebp - 0x14]
mov word [eax + 0x88], bx
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
mov word [edx + 0xa8], bx
mov word [ecx + 0xc8], bx
mov word [esi + 0xe8], bx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5efff8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8c0c32
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 1
call fcn.0040ae64
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
xor eax, eax
mov ebx, dword [ebp - 0x14]
mov byte [edx + 0x4c], al
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov byte [ebx + 0x4d], al
mov byte [esi + 0x4e], al
mov edi, dword [ecx]
push eax
push 0x3800
call dword [edi + 0x1c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x20], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x20]
add eax, 0x800
mov dword [ecx + 0x24], eax
mov esi, dword [ebp - 0x14]
mov ebx, dword [esi + 0x24]
add ebx, 0x800
mov dword [esi + 0x28], ebx
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + 0x28]
add edi, 0x800
mov dword [eax + 0x2c], edi
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x2c]
add eax, 0x800
mov dword [edx + 0x30], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
add eax, 0x800
mov dword [edx + 0x34], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x34]
add eax, 0x800
mov dword [0x9d4110], eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5f91c4
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8c1ae8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
mov dword [ecx], method.std::strstreambuf.virtual_12
mov ecx, dword [ebp - 0x14]
add ecx, 4
call fcn.0041cbf8
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 0x14]
lea ecx, [ebx + 0xc]
xor eax, eax
push eax
push eax
call fcn.005f92cc
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], 0
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
add ecx, 0x18
call fcn.0041cbf8
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0x1c
call fcn.0041cbf8
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
add ecx, 0x28
call fcn.0041cbf8
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x14]
add ecx, 0x38
call fcn.004e4b6c
mov dword [ebp - 4], 5
mov edx, dword [ebp - 0x14]
xor eax, eax
mov ebx, dword [ebp - 0x14]
mov dword [edx + 8], eax
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
mov byte [ebx + 0x22], al
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov byte [esi + 0x23], al
mov dword [edi + 0x30], eax
mov dword [ecx + 0x24], eax
mov ecx, dword [ebp - 0x14]
mov byte [edx + 0x20], al
mov edx, dword [ebp - 0x14]
mov byte [edx + 0x2c], al
call fcn.00566458
mov dword [ebp - 4], 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x60f3c8
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov al, byte [ecx]
mov dl, byte [ecx + 3]
mov byte [ecx], dl
mov byte [ecx + 3], al
mov al, byte [ecx + 1]
mov dl, byte [ecx + 2]
mov byte [ecx + 1], dl
mov dl, byte [ecx + 7]
mov byte [ecx + 2], al
mov al, byte [ecx + 4]
mov byte [ecx + 4], dl
mov dl, byte [ecx + 6]
mov byte [ecx + 7], al
mov al, byte [ecx + 5]
mov byte [ecx + 5], dl
mov dl, byte [ecx + 0xb]
mov byte [ecx + 6], al
mov al, byte [ecx + 8]
mov byte [ecx + 8], dl
mov dl, byte [ecx + 0xa]
mov byte [ecx + 0xb], al
mov al, byte [ecx + 9]
mov byte [ecx + 9], dl
mov dl, byte [ecx + 0xf]
mov byte [ecx + 0xa], al
mov al, byte [ecx + 0xc]
mov byte [ecx + 0xc], dl
mov dl, byte [ecx + 0xe]
mov byte [ecx + 0xf], al
mov al, byte [ecx + 0xd]
mov byte [ecx + 0xd], dl
mov byte [ecx + 0xe], al
xor eax, eax
mov bl, byte [eax + ecx + 0x10]
mov dl, byte [eax + ecx + 0x17]
mov byte [eax + ecx + 0x10], dl
mov dl, byte [eax + ecx + 0x16]
mov byte [eax + ecx + 0x17], bl
mov bl, byte [eax + ecx + 0x11]
mov byte [eax + ecx + 0x11], dl
mov dl, byte [eax + ecx + 0x15]
mov byte [eax + ecx + 0x16], bl
mov bl, byte [eax + ecx + 0x12]
mov byte [eax + ecx + 0x12], dl
mov dl, byte [eax + ecx + 0x14]
mov byte [eax + ecx + 0x15], bl
mov bl, byte [eax + ecx + 0x13]
mov byte [eax + ecx + 0x13], dl
mov dl, byte [eax + ecx + 0x1f]
mov byte [eax + ecx + 0x14], bl
mov bl, byte [eax + ecx + 0x18]
mov byte [eax + ecx + 0x18], dl
mov dl, byte [eax + ecx + 0x1e]
mov byte [eax + ecx + 0x1f], bl
mov bl, byte [eax + ecx + 0x19]
mov byte [eax + ecx + 0x19], dl
mov dl, byte [eax + ecx + 0x1d]
mov byte [eax + ecx + 0x1e], bl
mov bl, byte [eax + ecx + 0x1a]
mov byte [eax + ecx + 0x1a], dl
mov dl, byte [eax + ecx + 0x1c]
mov byte [eax + ecx + 0x1d], bl
mov bl, byte [eax + ecx + 0x1b]
mov byte [eax + ecx + 0x1b], dl
mov byte [eax + ecx + 0x1c], bl
add eax, 0x10
cmp eax, 0x70
jl 0x60f429
mov al, byte [ecx + 0x90]
mov dl, byte [ecx + 0x93]
mov byte [ecx + 0x90], dl
mov dl, byte [ecx + 0x92]
mov byte [ecx + 0x93], al
mov al, byte [ecx + 0x91]
mov byte [ecx + 0x91], dl
mov byte [ecx + 0x92], al
pop ebx
ret
Function at 0x6201c0
Capabilities:
Get file version info

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x18
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov edi, eax
xor esi, esi
mov dword [esp + 0xc], 0
push 0x8000
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebp, eax
lea edx, [esp + 0xc]
push edx
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x62020c
push ebx
call fcn.0089a0bb
mov dword [esp + 4], eax
add esp, 4
mov edx, eax
test edx, edx
jne 0x62021d
push ebp
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, esi
add esp, 0x18
pop ebx
pop ebp
pop esi
pop edi
ret
push edx
push ebx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x62028f
mov dword [esp + 0x10], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push ecx
push 0x9ef128
mov ebx, dword [esp + 0xc]
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x62028f
mov edx, dword [esp + 0x10]
movzx ecx, word [edx + 0xa]
mov ebx, dword [esp + 8]
mov word [ebx], cx
mov esi, dword [esp + 0x10]
mov edi, dword [esi + 8]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x38]
mov esi, 1
mov word [edx], di
mov edx, dword [esp + 0x10]
movzx edx, word [edx + 0xe]
mov word [ecx], dx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0xc]
mov ecx, dword [esp + 0x3c]
mov word [ecx], dx
mov edx, dword [esp]
push edx
call fcn.00899fd2
pop ecx
jmp 0x62020c
Function at 0x65e600
Capabilities:
Log keystrokes via polling

Disassembly:
push edi
push 0x10
xor edi, edi
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jge 0x65e617
mov edi, 0x10000000
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jge 0x65e62c
or edi, 0x20000000
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jge 0x65e641
or edi, 0x40000000
test edi, edi
je 0x65e66f
push 0x5b
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jge 0x65e65a
or edi, fcn.01000000
push 0x5c
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jge 0x65e66f
or edi, fcn.01000000
mov eax, edi
pop edi
ret

Function at 0x65e674
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push 1
xor ebp, ebp
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jge 0x65e68b
mov ebp, 1
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jge 0x65e69d
or ebp, 2
push 4
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jge 0x65e6af
or ebp, 4
mov eax, ebp
pop ebp
ret