joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ccb21
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov byte [ebp - 0x3c], 0x71
mov byte [ebp - 0x3b], 0xd5
mov byte [ebp - 0x3a], 0xac
mov byte [ebp - 0x39], 0xe3
mov byte [ebp - 0x38], 0xb3
mov byte [ebp - 0x37], 0x2b
mov byte [ebp - 0x36], 0x77
mov byte [ebp - 0x35], 0x6f
mov byte [ebp - 0x34], 0xcc
mov byte [ebp - 0x33], 0x37
mov byte [ebp - 0x32], 0x9f
mov byte [ebp - 0x31], 0x94
mov byte [ebp - 0x30], 0x8f
mov byte [ebp - 0x2f], 0x7f
mov byte [ebp - 0x2e], 0xa9
mov byte [ebp - 0x2d], 0xd6
mov byte [ebp - 0x2c], 0xec
mov byte [ebp - 0x2b], 0x9a
mov byte [ebp - 0x2a], 0x82
mov byte [ebp - 0x29], 0xcc
mov byte [ebp - 0x28], 0xa6
mov byte [ebp - 0x27], 0xef
mov byte [ebp - 0x26], 0x6e
mov byte [ebp - 0x25], 0x61
mov byte [ebp - 0x24], 0x77
mov byte [ebp - 0x23], 0xb8
mov byte [ebp - 0x22], 0x41
mov byte [ebp - 0x21], 0x25
mov byte [ebp - 0x20], 0x94
mov byte [ebp - 0x1f], 0xd7
mov byte [ebp - 0x1e], 0xe2
mov byte [ebp - 0x1d], 0xca
mov byte [ebp - 0x1c], 0x48
mov byte [ebp - 0x1b], 0x2a
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x19], 0x35
mov byte [ebp - 0x18], 0x33
mov byte [ebp - 0x17], 0x1e
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x15], 0xb8
mov byte [ebp - 0x14], 0x2d
mov byte [ebp - 0x13], 0x67
mov byte [ebp - 0x12], 0xb5
mov byte [ebp - 0x11], 0x8f
mov byte [ebp - 0x10], 0xce
mov byte [ebp - 0xf], 0x43
mov byte [ebp - 0xe], 0xff
mov byte [ebp - 0xd], 0x2b
mov byte [ebp - 0xc], 0xf9
mov byte [ebp - 0xb], 0x97
mov byte [ebp - 0xa], 6
mov byte [ebp - 9], 0xfe
mov byte [ebp - 8], 0xd2
mov byte [ebp - 7], 0x11
mov byte [ebp - 6], 0xec
mov byte [ebp - 5], 0x47
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x6ccc59
cmp dword [ebp + 0xc], 0
je 0x6ccc59
cmp dword [ebp + 0x10], 0
je 0x6ccc59
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x38
jbe 0x6ccc31
mov dword [ebp - 0x40], 0x38
jmp 0x6ccc39
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x40]
mov dword [eax], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00638a10
add esp, 0xc
jmp 0x6ccc6f
cmp dword [ebp + 0x10], 0
je 0x6ccc68
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov dword [ebp - 4], 0xffffffd6
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x6d3f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
and ecx, 0xff
mov byte [ebp - 0xc], cl
mov edx, dword [ebp + 0x10]
sar edx, 8
and edx, 0xff
mov byte [ebp - 0xb], dl
mov eax, dword [ebp + 0x10]
sar eax, 0x10
and eax, 0xff
mov byte [ebp - 0xa], al
mov ecx, dword [ebp + 0x10]
sar ecx, 0x18
and ecx, 0xff
mov byte [ebp - 9], cl
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
test edx, edx
je 0x6d3f8d
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov al, byte [ecx]
xor al, byte [ebp + edx - 0xc]
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 3
jle 0x6d3f82
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
jmp 0x6d3f4b
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x6e67ef
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov byte [ebp - 0x40], 0xc
mov byte [ebp - 0x3f], 0x52
mov byte [ebp - 0x3e], 0xe3
mov byte [ebp - 0x3d], 0xa8
mov byte [ebp - 0x3c], 0xf6
mov byte [ebp - 0x3b], 0xd4
mov byte [ebp - 0x3a], 0xc7
mov byte [ebp - 0x39], 0x68
mov byte [ebp - 0x38], 0xf2
mov byte [ebp - 0x37], 0x36
mov byte [ebp - 0x36], 0x1c
mov byte [ebp - 0x35], 0x88
mov byte [ebp - 0x34], 0x15
mov byte [ebp - 0x33], 0x36
mov byte [ebp - 0x32], 0x97
mov byte [ebp - 0x31], 0xde
mov byte [ebp - 0x30], 0x55
mov byte [ebp - 0x2f], 0x9a
mov byte [ebp - 0x2e], 0x9e
mov byte [ebp - 0x2d], 0xdf
mov byte [ebp - 0x2c], 5
mov byte [ebp - 0x2b], 0xd5
mov byte [ebp - 0x2a], 0xf3
mov byte [ebp - 0x29], 0x52
mov byte [ebp - 0x28], 0xe1
mov byte [ebp - 0x27], 0xe1
mov byte [ebp - 0x26], 0xcb
mov byte [ebp - 0x25], 0xfb
mov byte [ebp - 0x24], 0xb4
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0xca
mov byte [ebp - 0x20], 0x29
mov byte [ebp - 0x1f], 0xed
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x62
mov byte [ebp - 0x1c], 0x6a
mov byte [ebp - 0x1b], 0xba
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0xa1
mov byte [ebp - 0x18], 0xb0
mov byte [ebp - 0x17], 0x2b
mov byte [ebp - 0x16], 0x27
mov byte [ebp - 0x15], 0x60
mov byte [ebp - 0x14], 0x87
mov byte [ebp - 0x13], 0x81
mov byte [ebp - 0x12], 0xd1
mov byte [ebp - 0x11], 0xa4
mov byte [ebp - 0x10], 0x10
mov byte [ebp - 0xf], 0xf7
mov byte [ebp - 0xe], 0xd2
mov byte [ebp - 0xd], 0x6b
mov byte [ebp - 0xc], 0xce
mov byte [ebp - 0xb], 0xb5
mov byte [ebp - 0xa], 0x12
mov byte [ebp - 9], 0xc5
mov dword [ebp - 8], 0x38
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
ja 0x6e6906
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
lea eax, [ebp + edx - 0x40]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00638a10
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x70544c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov byte [ebp - 0x40], 0x6c
mov byte [ebp - 0x3f], 0xb0
mov byte [ebp - 0x3e], 0x4b
mov byte [ebp - 0x3d], 0xa0
mov byte [ebp - 0x3c], 0xad
mov byte [ebp - 0x3b], 0xef
mov byte [ebp - 0x3a], 0x73
mov byte [ebp - 0x39], 0x4e
mov byte [ebp - 0x38], 0xa3
mov byte [ebp - 0x37], 0x2f
mov byte [ebp - 0x36], 0x90
mov byte [ebp - 0x35], 0xd2
mov byte [ebp - 0x34], 0xb0
mov byte [ebp - 0x33], 0x45
mov byte [ebp - 0x32], 0xa2
mov byte [ebp - 0x31], 0x75
mov byte [ebp - 0x30], 0x85
mov byte [ebp - 0x2f], 0xe8
mov byte [ebp - 0x2e], 0xa3
mov byte [ebp - 0x2d], 0xfb
mov byte [ebp - 0x2c], 0x7b
mov byte [ebp - 0x2b], 0xd4
mov byte [ebp - 0x2a], 0x81
mov byte [ebp - 0x29], 0x38
mov byte [ebp - 0x28], 0xd6
mov byte [ebp - 0x27], 0xf5
mov byte [ebp - 0x26], 0xdc
mov byte [ebp - 0x25], 0xa4
mov byte [ebp - 0x24], 0xba
mov byte [ebp - 0x23], 0x4c
mov byte [ebp - 0x22], 0xf8
mov byte [ebp - 0x21], 0xb9
mov byte [ebp - 0x20], 0xe9
mov byte [ebp - 0x1f], 0x83
mov byte [ebp - 0x1e], 0x8a
mov byte [ebp - 0x1d], 0x7f
mov byte [ebp - 0x1c], 0xa6
mov byte [ebp - 0x1b], 0x18
mov byte [ebp - 0x1a], 0xac
mov byte [ebp - 0x19], 0x17
mov byte [ebp - 0x18], 0xb9
mov byte [ebp - 0x17], 0x88
mov byte [ebp - 0x16], 0x11
mov byte [ebp - 0x15], 0xaa
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x13], 0x47
mov byte [ebp - 0x12], 0xf3
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0x10], 0x37
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 2
mov byte [ebp - 0xd], 0xa
mov byte [ebp - 0xc], 0x1d
mov byte [ebp - 0xb], 0x3a
mov byte [ebp - 0xa], 0x9c
mov byte [ebp - 9], 0x69
mov dword [ebp - 8], 0x38
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
ja 0x705563
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
lea eax, [ebp + edx - 0x40]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00638a10
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x708a90
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
push edi
mov ecx, 0x18
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
pop edi
ret
Function at 0x1fa5f16
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
push ebx
mov ebx, dword [edx + 0x34]
jmp 0x10ac715
mov dword [ebp - 0x20], eax
add eax, 0x1b32062a
mov eax, dword [edx + 0x18]
push edi
shld di, bx, 0x59
bts edi, esp
sal di, 0xe8
mov edi, dword [edx + 0x10]
mov dword [ebp - 0xc], ecx
stc
mov ecx, dword [edx + 0x30]
test ax, sp
mov dword [ebp - 4], eax
adc ax, di
cmovle ax, bx
mov eax, dword [edx + 0x1c]
rcr dh, 0x32
sar dh, 0x5a
shl dl, 0x85
mov dword [ebp - 0x30], edi
or dh, ch
cmc
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x28], 0
dec eax
clc
test ax, 0x3b32
mov dword [ebp - 0x4c], eax
add ax, di
not ax
rcr ah, 0xb6
mov eax, 1
shl eax, cl
mov cx, 0x466f
bswap cx
mov ecx, dword [edx + 0x14]
jmp 0x1fa37f5
mov dword [ebp - 0x2c], ecx
mov ecx, dword [edx + 0x24]
jmp 0x21086a0
push ebp
mov ebp, esp
btr cx, 0x7b
bts ecx, edx
cwd
sub esp, 0x50
shl edx, 0xdc
mov edx, dword [ebp + 8]
mov ch, ah
mov eax, dword [edx + 0x38]
rcr cx, cl
bts ecx, ebx
mov ecx, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
cmp esi, eax
shr ax, 0xfb
cbw
mov eax, dword [edx + 0x40]
clc
stc
cmp edi, ebp
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
not ah
mov ecx, dword [edx + 0x44]
mov dword [ebp - 0x40], ecx
sub ah, bl
mov ecx, dword [edx + 8]
mov eax, 1
shl eax, cl
mov ecx, dword [edx + 4]
jmp 0x1041712
dec eax
mov dword [ebp - 0x50], eax
mov eax, dword [edx]
test esi, 0xc9c3e39
cmp ecx, ebx
mov dword [ebp - 0x48], eax
bsr ax, dx
not ah
mov eax, dword [edx + 0x28]
cmp sp, 0x353a
mov dword [ebp - 0x34], eax
shld eax, ebx, 7
cwde
mov eax, dword [edx + 0x2c]
push esi
shrd si, cx, 0x92
add si, 0x197b
mov esi, dword [edx + 0x20]
clc
jmp 0x10a4f9a
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x402e40
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, eax
and byte [esi + 8], 9
mov al, byte [esi + 8]
test al, 1
je 0x402e76
test al, 8
jne 0x402e76
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x402e76
or byte [esi + 8], 4
mov cl, byte [esi + 8]
test eax, 0x21000000
jne 0x402e76
or cl, 2
mov byte [esi + 8], cl
test byte [esi + 8], 2
je 0x402e91
mov eax, dword [esi + 0x28]
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, edi
call fcn.00402c40
pop esi
ret
mov ecx, dword [esi + 0x28]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x403840
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4388ab
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x448018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ebx, ecx
mov ecx, dword [edi + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [ebp - 0xb4]
push edx
call eax
xor esi, esi
mov dword [ebp - 4], esi
mov eax, str.http:__bbs.ledu.com_forum_365_1.html
mov dword [ebp - 0x30], str.guanwang_btn
mov dword [ebp - 0x2c], str.http:__cqby.ledu.com_
mov dword [ebp - 0x28], str.chongzhi_btn
mov dword [ebp - 0x24], str.http:__epay.ledu.com_
mov dword [ebp - 0x20], str.kefu_btn
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], str.luntan_btn
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + esi*8 - 0x30]
push ecx
lea ecx, [ebp - 0xb4]
call fcn.00408cd7
test al, al
jne 0x4038dd
inc esi
cmp esi, 4
jb 0x4038c1
jmp 0x4038f5
mov edx, dword [ebp + esi*8 - 0x2c]
push 1
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
mov ecx, ebx
call fcn.00409a19
lea ecx, [ebp - 0xb4]
mov dword [ebp - 4], 0xffffffff
call fcn.00408900
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403b76
mov esp, ebp
pop ebp
ret 4

Function at 0x403b76
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x448018]
jne 0x403b80
repz ret
jmp fcn.00404056

Function at 0x4044e7
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jge 0x4044fd
push 8
pop edi
push 2
call esi
test ax, ax
jge 0x404509
or edi, 1
push 1
call esi
test ax, ax
jge 0x404515
or edi, 2
push 0x10
call esi
test ax, ax
jge 0x404521
or edi, 4
push 0x12
call esi
test ax, ax
jge 0x40452d
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret
Function at 0x40637a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
mov ebx, dword [ebp + 8]
cmp eax, ecx
je 0x4063a2
cmp ebx, dword [esi + 0x140]
je 0x4063a2
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x140]
cmp ebx, eax
je 0x406479
push edi
test eax, eax
je 0x406401
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x140]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x140]
mov ecx, esi
call fcn.00405e71
mov dword [esi + 0x140], edi
test ebx, ebx
je 0x406478
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x406478
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc8]
test al, al
je 0x406478
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xd4]
test al, al
je 0x406478
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x140], ebx
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x140]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x140]
mov ecx, esi
call fcn.00405e71
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x406694
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x1bc]
mov ecx, edi
xor ebx, ebx
call fcn.0040f3c3
test eax, eax
jle 0x4066e3
push ebx
mov ecx, edi
mov byte [ebp - 1], 0
call fcn.004088cf
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x406747
mov ecx, edi
inc ebx
call fcn.0040f3c3
cmp ebx, eax
jl 0x4066b2
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x4067ac
sub eax, 4
je 0x40674b
dec eax
dec eax
jne 0x4067a3
push dword [ebp + 0xc]
mov word [ebp + 8], ax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
call sub.MSVCR100.dll_toupper
pop ecx
mov ecx, dword [esi + 0x13c]
push 0x8000000a
lea edx, [ebp + 8]
push edx
mov word [ebp + 8], ax
mov eax, dword [ecx]
push 0x4056e9
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x4067a3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xf0]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x4067a5
cmp dword [esi + 0x140], 0
je 0x4067a3
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x10], ax
mov eax, dword [esi + 0x150]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x154]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.004044e7
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x140]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x4067a3
cmp dword [esi + 0x140], 0
je 0x40680a
mov ecx, dword [esi + 0x140]
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x40680a
mov ecx, dword [esi + 0x140]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x40680a
mov ecx, dword [esi + 0x140]
mov eax, dword [ecx]
push str.RichEditUI
call dword [eax + 0xc]
push eax
call sub.MSVCR100.dll_wcsstr
pop ecx
pop ecx
test eax, eax
je 0x40680a
mov ecx, dword [esi + 0x140]
call fcn.00416a4f
test al, al
jne 0x4067a3
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge al
movzx eax, al
push eax
mov ecx, esi
call fcn.0040653f
jmp 0x406747
Function at 0x40c55e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x40c569
xor eax, eax
ret
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x40c624
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43ae38]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43ae38]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43ae38]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43ae38]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43ae38]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43ae38]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43ae38]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43ae38]
inc edx
sub edi, 8
dec esi
jne 0x40c589
pop ebx
test edi, edi
je 0x40c63d
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x43ae38]
inc edx
dec edi
jne 0x40c628
pop edi
not eax
pop esi
ret

Function at 0x40cad4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x40cb08
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40cb03
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x40cb30
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x40cb19
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call sub.MSVCR100.dll_memcpy
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret
Function at 0x40d8cd
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x448018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x40d977
movzx ecx, word [esi]
test cx, cx
je 0x40d977
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x40d90b
cmp cx, 0x5c
jne 0x40d90d
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x40d8ff
cmp eax, esi
je 0x40d94b
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call sub.MSVCR100.dll_wcsncpy
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0040d8cd
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call sub.MSVCR100.dll_wcscpy
lea eax, [ebp - 0x414]
push esi
push eax
call sub.MSVCR100.dll_wcscat
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00403b76
leave
ret

Function at 0x40eea8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x40ef23
cmp dword [esi + 4], 0xffffffff
jne 0x40ef23
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x43b434
push edi
call sub.MSVCR100.dll_wcscat
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x40eef5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x40eef5
mov eax, 0x2000000
jmp 0x40ef28
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040c8ea
add esp, 0x10
test eax, eax
jne 0x40ef13
mov eax, dword [ebp + 0x10]
jmp 0x40ef28
push eax
call fcn.0040eaa4
mov dword [esi], eax
mov eax, dword [0x4497ec]
pop ecx
jmp 0x40ef28
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x416c88
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4d8], ebx
je 0x416cf0
cmp dword [ebp + 8], 0x100
jne 0x416cdf
cmp word [ebp + 0xc], 0xd
jne 0x416cdf
cmp byte [esi + 0x4de], bl
je 0x416cc6
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x416cdf
cmp byte [esi + 0x4df], bl
jne 0x416cdf
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x416cdb
push ebx
push ebx
push ebx
push str.return
push esi
call fcn.00405e71
xor eax, eax
jmp 0x416cf3
mov eax, dword [esi + 0x4d8]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x42f947
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x448018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x18], bl
je 0x42f9b8
cmp dword [esi + 0x10], ebx
je 0x42f9b8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.00436c60
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x42f9b8
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x1b8
call fcn.00408a7c
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00405e71
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403b76
leave
ret 0x10