joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407dba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42228c]
jne 0x407dc4
repz ret
jmp fcn.0040986b

Function at 0x412e75
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a614
and dword [ebp - 4], 0
cmp dword [0x427610], 0
mov ebx, eax
jne 0x412f26
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x412fd7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x412fd7
push eax
call fcn.0040a5a2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x427610], eax
call esi
push eax
call fcn.0040a5a2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x427614], eax
call esi
push eax
call fcn.0040a5a2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x427618], eax
call esi
push eax
call fcn.0040a5a2
pop ecx
mov dword [0x427620], eax
test eax, eax
je 0x412f26
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a5a2
pop ecx
mov dword [0x42761c], eax
mov eax, dword [0x42761c]
cmp eax, ebx
je 0x412f7e
cmp dword [0x427620], ebx
je 0x412f7e
push eax
call fcn.0040a61d
push dword [0x427620]
mov esi, eax
call fcn.0040a61d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x412f7e
test edi, edi
je 0x412f7e
call esi
test eax, eax
je 0x412f75
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x412f75
test byte [ebp - 0xc], 1
jne 0x412f7e
or dword [ebp + 0x10], 0x200000
jmp 0x412fb7
mov eax, dword [0x427614]
cmp eax, ebx
je 0x412fb7
push eax
call fcn.0040a61d
pop ecx
test eax, eax
je 0x412fb7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x412fb7
mov eax, dword [0x427618]
cmp eax, ebx
je 0x412fb7
push eax
call fcn.0040a61d
pop ecx
test eax, eax
je 0x412fb7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x427610]
call fcn.0040a61d
pop ecx
test eax, eax
je 0x412fd7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x412fd9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5196e8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, eax
xor eax, eax
push ebp
push 0x5198f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x52b318]
mov eax, dword [eax]
xor edx, edx
push edx
push eax
mov eax, ecx
cdq
cmp edx, dword [esp + 4]
jne 0x51971b
cmp eax, dword [esp]
pop edx
pop eax
je 0x5198e2
mov eax, dword [0x52b318]
mov dword [eax], ecx
mov eax, dword [0x52b318]
cmp dword [eax], 0
jne 0x51973e
mov eax, 0x51990c
call fcn.00432c7c
mov eax, dword [0x52b430]
push eax
mov eax, dword [0x52b318]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [0x52b430]
mov eax, dword [eax]
call fcn.004feafc
mov eax, dword [0x52b430]
mov eax, dword [eax]
push eax
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov edx, dword [0x52b2d4]
mov dword [edx], eax
push 0x40
push 0x1000
push 0x1000
push 0
mov eax, dword [0x52b2d4]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov edx, dword [0x52b690]
mov dword [edx], eax
push 0x40
push 0x1000
push 0x1000
push 0
mov eax, dword [0x52b2d4]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov edx, dword [0x52b454]
mov dword [edx], eax
call fcn.00519460
push 0x40
push 0x1000
push 0x1000
push 0
mov eax, dword [0x52b2d4]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov ebx, eax
mov eax, dword [0x52b76c]
mov dword [eax + 0x34], ebx
mov eax, dword [0x52b76c]
add ebx, 0x200
mov eax, dword [0x52b970]
mov dword [eax + 0x90], ebx
call fcn.005187ac
mov eax, dword [0x52b87c]
cmp dword [eax], 0
jne 0x519834
mov eax, dword [0x52b318]
mov eax, dword [eax]
push eax
mov ecx, dword [0x52b430]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x51f9b8]
call fcn.005201cc
mov edx, dword [0x52b87c]
mov dword [edx], eax
jmp 0x51989c
mov eax, dword [0x52b87c]
mov eax, dword [eax]
mov eax, dword [eax + 0x334]
mov edx, dword [0x52b430]
cmp eax, dword [edx]
je 0x51989c
mov eax, dword [0x52b87c]
mov eax, dword [eax]
mov byte [eax + 0x348], 1
mov eax, dword [0x52b87c]
mov eax, dword [eax]
mov edx, 0x3e8
call fcn.0051fa38
mov eax, dword [0x52b318]
mov eax, dword [eax]
push eax
mov ecx, dword [0x52b430]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x51f9b8]
call fcn.005201cc
mov edx, dword [0x52b87c]
mov dword [edx], eax
jmp 0x51989c
mov eax, dword [0x52b83c]
mov eax, dword [eax]
call fcn.0046132c
mov eax, dword [0x52ba40]
cmp byte [eax], 0
je 0x519890
push 0x12c
call sub.KERNEL32.DLL_Sleep
xor eax, eax
mov dword [ebp - 4], eax
push 4
lea ecx, [ebp - 4]
mov edx, 0x5201a0
mov eax, dword [0x52b87c]
mov eax, dword [eax]
call fcn.005200d0
lea eax, [ebp - 8]
call fcn.0051b388
mov edx, dword [ebp - 8]
mov eax, dword [0x52ba54]
mov eax, dword [eax]
call fcn.004683bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5198ff
lea eax, [ebp - 8]
call fcn.00404718
ret
Function at 0x519bac
Capabilities:
Create thread
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor eax, eax
push ebp
push 0x519d20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x52b9c4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [0x52b768]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [0x52ba54]
mov eax, dword [eax]
mov eax, dword [eax + 0x300]
mov edx, dword [eax]
call dword [edx + 0xd8]
push 0
push 0x519d44
call sub.user32.dll_EnumWindows
mov eax, dword [0x52b9c4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jge 0x519c17
mov eax, 0x519d34
call fcn.00432c7c
jmp 0x519d0a
lea ecx, [ebp - 4]
mov eax, dword [0x52b9c4]
mov eax, dword [eax]
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 4]
call fcn.00409060
call fcn.005196e8
call fcn.00519af8
mov eax, dword [0x52ba54]
mov eax, dword [eax]
mov eax, dword [eax + 0x300]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov eax, dword [0x52ba54]
mov eax, dword [eax]
mov ebx, dword [eax + 0x300]
mov edx, dword [0x52ba54]
mov edx, dword [edx]
mov eax, dword [ebx + 0x124]
call dword [ebx + 0x120]
mov eax, dword [0x52b4b4]
cmp dword [eax], 0
jne 0x519c90
mov dl, 1
mov eax, dword [0x5115c0]
call fcn.005116e4
mov edx, dword [0x52b4b4]
mov dword [edx], eax
mov eax, dword [0x52ba34]
cmp dword [eax], 0
jne 0x519cae
mov dl, 1
mov eax, dword [0x511620]
call fcn.00511a4c
mov edx, dword [0x52ba34]
mov dword [edx], eax
mov eax, dword [0x52b448]
cmp dword [eax], 0
jne 0x519ccc
mov dl, 1
mov eax, dword [0x511680]
call fcn.005117dc
mov edx, dword [0x52b448]
mov dword [edx], eax
mov eax, dword [0x52b994]
cmp dword [eax], 0
jne 0x519cf6
mov eax, dword [0x52b70c]
push eax
push 0
push 0
push 0x51750c
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov edx, dword [0x52b994]
mov dword [edx], eax
mov eax, dword [0x52ba54]
mov eax, dword [eax]
mov eax, dword [eax + 0x30c]
mov dl, 1
call fcn.0043483c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519d27
lea eax, [ebp - 4]
call fcn.00404718
ret
Function at 0x51fa38
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetTickCount
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
xor eax, eax
push ebp
push 0x51faba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x349], 0
je 0x51fa78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51fac6
call sub.KERNEL32.DLL_GetTickCount
xor edx, edx
sub eax, dword [ebp - 0x18]
sbb edx, dword [ebp - 0x14]
push edx
push eax
mov eax, dword [ebp - 8]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x51fa9b
cmp eax, dword [esp]
pop edx
pop eax
jae 0x51faa9
jmp 0x51fa9f
pop edx
pop eax
jge 0x51faa9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51fac6
push 0x64
call sub.KERNEL32.DLL_Sleep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51fa54
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51ffb4
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov dword [ebx + 0x124], 0x10010
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x128], eax
mov eax, dword [ebx + 0x44]
mov dword [ebx + 0x12c], eax
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0x130], eax
mov eax, dword [ebx + 0x4c]
mov dword [ebx + 0x134], eax
mov dword [ebx + 0x13c], 0xff
mov eax, dword [ebx + 0x330]
call fcn.00405910
mov edi, eax
dec edi
test edi, edi
jl 0x520061
inc edi
xor esi, esi
lea ebp, [esi + esi*4]
mov edx, dword [ebx + 0x330]
mov edx, dword [edx + ebp*4 + 4]
mov eax, dword [ebx + 0x33c]
cmp edx, eax
je 0x520023
test eax, eax
jne 0x52005d
lea eax, [esi + esi*4]
mov edx, dword [ebx + 0x330]
mov eax, dword [edx + eax*4 + 4]
push eax
call sub.KERNEL32.DLL_SuspendThread
lea eax, [ebx + 0x124]
push eax
mov eax, dword [ebx + 0x330]
mov eax, dword [eax + ebp*4 + 4]
push eax
call sub.KERNEL32.DLL_SetThreadContext
mov eax, dword [ebx + 0x330]
mov eax, dword [eax + ebp*4 + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
inc esi
dec edi
jne 0x520008
mov al, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5200d0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x1000
push 0
mov eax, dword [ebx + 0x54]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov esi, eax
push 0x40
push 0x1000
mov eax, dword [ebp + 8]
add eax, 4
push eax
push 0
mov eax, dword [ebx + 0x54]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push 0x32
mov eax, dword [ebp - 4]
push eax
push esi
mov eax, dword [ebx + 0x54]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
mov eax, dword [ebx + 0x54]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
lea eax, [ebp - 0x14]
push eax
push 0
push edi
push esi
push 0
push 0
mov eax, dword [ebx + 0x54]
push eax
call sub.KERNEL32.DLL_CreateRemoteThread
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
push 0x8000
push 0
push esi
mov eax, dword [ebx + 0x54]
push eax
call sub.KERNEL32.DLL_VirtualFreeEx
push 0x8000
push 0
push edi
mov eax, dword [ebx + 0x54]
push eax
call sub.KERNEL32.DLL_VirtualFreeEx
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5207cc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, 0x520384
call fcn.00406928
xor eax, eax
push ebp
push 0x5209a1
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00513710
mov eax, dword [0x52b420]
mov dword [eax], 0xa3d70a4
mov dword [eax + 4], 0x3ffca3d7
call fcn.0051311c
call fcn.004ff5c4
call fcn.0051e964
mov eax, 0x22b9
call fcn.00403194
inc eax
mov edx, dword [0x52b888]
mov dword [edx], eax
lea edx, [ebp - 0x18]
mov eax, dword [0x52b83c]
mov eax, dword [eax]
call fcn.00461ae8
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409568
mov edx, dword [ebp - 0x14]
mov eax, dword [0x52b66c]
call fcn.0040476c
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.00402b54
mov eax, dword [ebp - 0x1c]
mov edx, 0x5209b8
call fcn.00404b24
je 0x520897
mov eax, dword [0x52b8e4]
push eax
push 0
push 0
push 0x51c0dc
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov edx, dword [0x52b2c0]
mov dword [edx], eax
mov eax, dword [0x52b83c]
mov eax, dword [eax]
call fcn.00461440
lea edx, [ebp - 0x20]
mov eax, 3
call fcn.00402b54
mov eax, dword [ebp - 0x20]
mov edx, 0x5209dc
call fcn.00404b24
jne 0x5208d0
mov eax, dword [0x52b644]
mov edx, 0x5209f0
call fcn.0040476c
jmp 0x5208df
mov eax, dword [0x52b644]
mov edx, 0x520a18
call fcn.0040476c
mov ecx, dword [0x52b83c]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x5083a0]
call fcn.00459b58
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xec]
dec eax
jne 0x52095f
mov eax, ebx
call fcn.004038e4
mov ecx, dword [0x52ba54]
mov eax, dword [0x52b83c]
mov eax, dword [eax]
mov edx, dword [0x509b70]
call fcn.00461458
mov ecx, dword [0x52b7c0]
mov eax, dword [0x52b83c]
mov eax, dword [eax]
mov edx, dword [0x50762c]
call fcn.00461458
mov ecx, dword [0x52b588]
mov eax, dword [0x52b83c]
mov eax, dword [eax]
mov edx, dword [0x509644]
call fcn.00461458
mov eax, dword [0x52b83c]
mov eax, dword [eax]
call fcn.004614d8
jmp 0x520986
xor eax, eax
push ebp
push 0x52097c
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00513420
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x520986
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5209a8
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.0040473c
ret
Function at 0x401140
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401165
lea ecx, [esp + 0xc]
push 0
push ecx
push 0x7400
push 0x406030
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401183
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop esi
pop ebx
ret

Function at 0x401230
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x130
push ebx
push 0
push 2
mov dword [esp + 0xc], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
test ebx, ebx
je 0x4012d2
push ebp
push esi
lea eax, [esp + 0x14]
push edi
push eax
push ebx
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4012b3
mov esi, dword [esp + 0x144]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x40]
push ecx
push esi
call ebp
test eax, eax
je 0x4012a3
lea edx, [esp + 0x18]
push edx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401279
jmp 0x4012b3
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
cmp eax, 1
pop ebp
jne 0x4012d2
mov eax, dword [esp + 8]
pop ebx
add esp, 0x130
ret
xor eax, eax
pop ebx
add esp, 0x130
ret
Function at 0x402040
Capabilities:
Create directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x403678
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [esp + 0x14]
push edi
push 0
mov edi, ecx
mov eax, dword [esi]
push eax
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
cmp eax, 0xffffffff
jne 0x4020bc
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4020bc
push 0x5c
mov ecx, esi
call sub.MFC42.DLL_CString::ReverseFind
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, edi
mov dword [esp + 0x14], 0
call fcn.00402040
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.004030ac
mov edx, dword [esi]
push edx
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4

Function at 0x402340
Capabilities:
Parse pe header

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
cmp word [eax], 0x5a4d
push edi
je 0x402358
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [esp + 0x10], edi
cmp dword [edi], 0x4550
je 0x402371
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push eax
push ecx
call esi
mov ebp, eax
test ebp, ebp
jne 0x4023a8
mov edx, dword [edi + 0x50]
push 4
push 0x2000
push edx
push eax
call esi
mov ebp, eax
test ebp, ebp
jne 0x4023a8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
xor eax, eax
push 4
push 0x1000
mov dword [ebx + 4], ebp
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x50]
push eax
push ebp
call esi
mov ecx, dword [edi + 0x54]
push 4
push 0x1000
push ecx
push ebp
call esi
mov esi, dword [esp + 0x18]
mov edx, dword [edi + 0x54]
mov edi, eax
push ebx
mov ecx, dword [esi + 0x3c]
add ecx, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
push esi
push ecx
mov edx, dword [ecx + 0x3c]
add eax, edx
mov dword [ebx], eax
mov dword [eax + 0x34], ebp
call fcn.00402490
mov ecx, dword [esi + 0x34]
mov eax, ebp
add esp, 0xc
sub eax, ecx
je 0x402431
push eax
push ebx
call fcn.00402620
add esp, 8
push ebx
call fcn.004026a0
add esp, 4
test eax, eax
je 0x402461
push ebx
call fcn.00402560
mov eax, dword [ebx]
add esp, 4
mov eax, dword [eax + 0x28]
test eax, eax
je 0x402479
add eax, ebp
test eax, eax
je 0x402461
push 0
push 1
push ebp
call eax
test eax, eax
jne 0x402472
push ebx
call fcn.004028c0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [ebx + 0x10], 1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
Function at 0x402490
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
xor ecx, ecx
mov ebp, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x402551
push esi
push edi
add ebx, 0x10
cmp dword [ebx], 0
jne 0x4024fb
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x40252f
mov eax, dword [ebx - 4]
push 4
push 0x1000
add eax, ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x40252f
mov ecx, dword [ebx - 4]
mov eax, dword [ebx]
push 4
push 0x1000
add ecx, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 0x18]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x4024be
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x402560
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
xor ecx, ecx
push ebp
mov ebx, dword [eax]
xor ebp, ebp
mov cx, word [ebx + 0x14]
cmp word [ebx + 6], bp
lea eax, [ecx + ebx + 0x18]
jbe 0x402614
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4025b7
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4025fa
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov edx, dword [edx*4 + 0x4148c8]
je 0x4025ce
or dh, 2
mov ecx, dword [edi - 0x14]
test ecx, ecx
jne 0x4025e7
test al, 0x40
je 0x4025de
mov ecx, dword [ebx + 0x20]
jmp 0x4025e5
test al, 0x80
je 0x4025fa
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x4025fa
lea eax, [esp + 0x10]
push eax
push edx
push ecx
mov ecx, dword [edi - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
xor eax, eax
inc ebp
add edi, 0x28
mov ebx, dword [edx]
mov ax, word [ebx + 6]
cmp ebp, eax
jl 0x402584
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x41c700
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.004d5b50
mov dword [esp], 0xc8
mov dword [esp + 4], 0x96
push 0
call fcn.004c020d
mov ebx, eax
push 0
call fcn.004c050d
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 8], ebx
push 0
call fcn.004c027a
mov ebx, eax
push 0
call fcn.004c0589
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp + 4]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 0xc], ebx
push 0x80000004
push dword [0x14c6510]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x60
call fcn.004bfc38
push 0xb
push 0x67
call fcn.004ce8ad
push eax
push 0x1a
push 0xaa
push 0xf
push 0xf
push 0x63
call fcn.004b9fde
push 0xb
push 0x65
call fcn.004ce8ad
push eax
push 0x1a
push 0xaa
push 0x2d
push 0xf
push 0x61
call fcn.004b9fde
push 0xb
push 0x66
call fcn.004ce8ad
push eax
push 0x1a
push 0xaa
push 0x4b
push 0xf
push 0x62
call fcn.004b9fde
push dword [0x14c665c]
push 0x14
push 0xaa
push 0x78
push 0xf
push 0x64
call fcn.004b76be
call fcn.0044300a
call fcn.004bfc30
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x41c911
call fcn.004c3a96
push eax
mov ebx, 0x60
cmp ebx, dword [esp]
jne 0x41c90e
push dword [esp + 0x20]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x41c90d
call fcn.004c3a87
push eax
mov ebx, 0x63
cmp ebx, dword [esp]
jne 0x41c8c2
mov eax, 0x5f4766
push eax
call fcn.0049569a
add esp, 0xc
jmp 0x41c968
mov ebx, 0x61
cmp ebx, dword [esp]
jne 0x41c8e1
mov eax, 0x5f4766
push eax
call fcn.0049569a
add esp, 0xc
jmp 0x41c968
mov ebx, 0x62
cmp ebx, dword [esp]
jne 0x41c8fd
mov eax, 0x5f4766
push eax
call fcn.0049569a
add esp, 0xc
jmp 0x41c968
mov ebx, 0x64
cmp ebx, dword [esp]
jne 0x41c90c
add esp, 0xc
jmp 0x41c968
pop eax
pop eax
pop eax
jmp 0x41c91b
push 0x60
call fcn.004bfc12
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x41c93f
call fcn.004c0597
mov ebx, eax
cmp ebx, 0x60
jne 0x41c93f
call fcn.0044300a
jmp 0x41c968
push 0xd
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x41c963
call fcn.004c0597
mov ebx, eax
cmp ebx, 0x60
jne 0x41c963
call fcn.0044300a
jmp 0x41c968
jmp 0x41c86b
push 0x60
call fcn.004bf9c0
xor eax, eax
add esp, 0x10
pop edi
pop ebx
ret 4
Function at 0x44e61e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.004d5b50
mov dword [esp], 0
jmp 0x44e631
mov eax, dword [esp + 0x10]
cmp eax, dword [esp]
jl 0x44e6ea
push 0
call fcn.004bfaf1
and eax, eax
je 0x44e6e1
mov dword [esp + 4], 0xffffffff
call fcn.00454750
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
and ebx, ebx
jle 0x44e6b0
call fcn.004c3a96
push eax
mov ebx, dword [0x14c667c]
cmp ebx, dword [esp]
jne 0x44e68b
push dword [esp + 8]
call fcn.0044d195
mov ebx, eax
and ebx, ebx
jne 0x44e689
jmp 0x44e6ad
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x44e6a3
push dword [esp + 8]
call fcn.0043f942
mov ebx, eax
and ebx, ebx
jne 0x44e6a1
jmp 0x44e6ad
push 3
call fcn.004bf7e3
pop eax
jmp 0x44e6ba
push 5
call fcn.004bf7e3
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x44e6d7
mov dword [0x14c662c], 1
jmp 0x44e6e1
mov dword [0x14c662c], 0
inc dword [esp]
jno 0x44e631
xor eax, eax
add esp, 8
pop ebx
ret 4