joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417e10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x58
mov eax, dword [0x630038]
mov dword [esp + 4], 0
push esi
lea ecx, [eax + eax]
mov eax, dword [0x63003c]
or ecx, eax
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x60]
fild qword [esp + 4]
test ecx, ecx
fadd qword [0x630050]
fstp qword [0x630050]
je 0x417e63
mov eax, dword [0x6337e0]
test eax, eax
je 0x417e57
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x58
ret 4
mov dl, byte [0x630042]
mov cl, byte [0x630049]
xor cl, dl
mov edx, dword [0x630030]
mov byte [0x630049], cl
mov ecx, dword [0x630034]
and ecx, 4
and eax, 0xc
add edx, ecx
mov esi, dword [0x630038]
mov dword [0x630030], edx
mov edx, dword [0x630048]
and edx, 0xff
push ebp
imul eax, edx
xor esi, eax
push edi
lea eax, [esp + 0x14]
push 0x50
push eax
mov dword [0x630038], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x15]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [0x63004e]
mov ecx, ebp
and ecx, 3
lea edx, [esp + 0x14]
rep movsb byte es:[edi], byte [esi]
mov cl, byte [0x630040]
push edx
and cl, al
mov byte [0x630040], cl
mov cl, byte [0x630047]
or cl, 2
shr cl, 1
and ecx, 0xff
mov dword [esp + 0x6c], ecx
fild dword [esp + 0x6c]
fdivr qword [0x630050]
fadd qword [0x62e2b8]
fstp qword [0x6339b0]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6337e0], eax
test eax, eax
pop ebp
je 0x417f88
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov dword [0x6337dc], eax
mov eax, dword [0x6337e0]
push str.DirectSoundEnumerateA
push eax
call esi
mov ecx, dword [0x6337dc]
mov dword [0x6337e4], eax
test ecx, ecx
je 0x417f7e
test eax, eax
je 0x417f7e
mov eax, 1
pop esi
add esp, 0x58
ret 4
mov dword [0x6337e0], 0
xor eax, eax
pop esi
add esp, 0x58
ret 4
Function at 0x6295d5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6303b8
cmp edx, dword [eax]
je 0x6295f7
add eax, 8
inc ecx
cmp eax, 0x630448
jl 0x6295e8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6303b8]
jne 0x629725
mov eax, dword [0x635d50]
cmp eax, 1
je 0x6296ff
test eax, eax
jne 0x629628
cmp dword [0x6302e4], 1
je 0x6296ff
cmp edx, 0xfc
je 0x629725
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62965f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629fc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a450
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x6296a2
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a450
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62e63c
push edi
call fcn.0062c320
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629fc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629fd0
lea eax, [ebp - 0xa0]
push 0x62e61c
push eax
call fcn.00629fd0
push dword [esi + 0x6303bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629fd0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062c294
add esp, 0x2c
pop edi
jmp 0x629725
lea eax, [ebp + 8]
lea esi, [esi + 0x6303bc]
push 0
push eax
push dword [esi]
call fcn.0062a450
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x431072
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1a396730
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6aa710f
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x403085
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x413c5c
call fcn.004134f0
sub esp, 0xc
push esi
mov esi, ecx
push edi
push dword [ebp + 8]
lea edi, [esi + 0x68]
lea ecx, [edi + 0xc]
call fcn.00401d6e
push 0
push 0x1f4
mov ecx, edi
call fcn.00406218
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
call fcn.00413220
push 0x45
lea ecx, [ebp - 0x18]
pop edx
call fcn.0040603c
mov edx, dword [eax]
mov ecx, dword [esi + 0x6c]
and dword [ebp - 4], 0
call fcn.00406056
push dword [ebp - 0x18]
call fcn.00403a9e
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x4048a9
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret

Function at 0x4048c4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x41a710], 0
push esi
mov esi, edx
jne 0x4048fc
mov edx, ecx
push ebx
lea ecx, [ebp - 0xc]
call fcn.0040490c
mov eax, dword [eax]
mov edx, esi
mov ecx, eax
call fcn.004048a9
mov bl, al
push dword [ebp - 0xc]
call fcn.00403a9e
pop ecx
mov al, bl
pop ebx
jmp 0x404909
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop esi
leave
ret

Function at 0x40495b
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x41a710], 0
jne 0x40498c
mov edx, ecx
push ebx
lea ecx, [ebp - 0xc]
call fcn.0040490c
mov ecx, dword [eax]
call fcn.004048b7
mov bl, al
push dword [ebp - 0xc]
call fcn.00403a9e
pop ecx
mov al, bl
pop ebx
leave
ret
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
leave
ret

Function at 0x4049a9
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x41a710], 0
jne 0x4049da
mov edx, ecx
push ebx
lea ecx, [ebp - 0xc]
call fcn.0040490c
mov ecx, dword [eax]
call fcn.0040499a
mov bl, al
push dword [ebp - 0xc]
call fcn.00403a9e
pop ecx
mov al, bl
pop ebx
leave
ret
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
leave
ret

Function at 0x404c07
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x41a710], 0
push esi
mov esi, ecx
jne 0x404c3b
push ebx
mov edx, esi
lea ecx, [ebp - 0xc]
call fcn.0040490c
mov ecx, dword [eax]
call fcn.00404be9
mov bl, al
push dword [ebp - 0xc]
call fcn.00403a9e
pop ecx
mov al, bl
pop ebx
jmp 0x404c54
xor edx, edx
mov ecx, esi
call fcn.004048c4
test al, al
je 0x404c54
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop esi
leave
ret

Function at 0x4050b8
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, 0x105
push edi
mov edi, edx
cmp dword [esi + 8], eax
mov ebx, ecx
jg 0x4050d5
push eax
mov ecx, esi
call fcn.0040242a
push dword [esi]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, esi
mov edi, eax
call fcn.004042a2
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x405a90
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405ab6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x405ab6
xor al, al
jmp 0x405ad6
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.004136b0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x40cde4
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x414ef0
call fcn.004134f0
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x416654
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x416708
push 4
mov ebx, 0x416644
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00403290
mov dword [esi + 0x3c], 0x4167b8
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.00403290
mov dword [edi], 0x4167c0
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b974
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.0040c3d1
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b974
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.0040c3d1
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b974
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.0040c3d1
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b974
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.0040c3d1
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.0040c3d1
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x413230
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x413258
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413267
mov eax, 1
ret 4
Function at 0x4010ac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
push 0x40fa4c
lea eax, [ebp - 4]
xor edi, edi
push 0x412b60
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
call fcn.00401a35
xor ecx, ecx
cmp eax, edi
sete cl
push str.Failed_to_open_executable
push ecx
call fcn.00401000
push 2
push edi
push dword [ebp - 4]
call fcn.00402941
push dword [ebp - 4]
call fcn.00402852
cdq
mov dword [ebp - 0x18], eax
add eax, 0xfffffefc
add esp, 0x24
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], eax
cmp eax, edi
jge 0x40110c
mov dword [ebp - 8], edi
push ebx
push esi
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00402941
push dword [ebp - 4]
mov ebx, 0x104
push ebx
push 1
push dword [ebp + 8]
call fcn.00402462
push dword [ebp + 8]
mov esi, eax
call fcn.0040106a
add esp, 0x20
cmp eax, edi
je 0x40115b
mov esi, eax
push 5
pop ecx
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
sub eax, edi
add eax, dword [ebp - 8]
cdq
mov esi, eax
mov dword [ebp - 0x14], edx
jmp 0x4011dc
mov esi, 0x4100000
push esi
call fcn.00401d27
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
add eax, 0xfbf00000
pop ecx
mov dword [ebp - 8], eax
cmp eax, edi
jge 0x40117c
mov dword [ebp - 8], edi
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00402941
push dword [ebp - 4]
push esi
push 1
push dword [ebp - 0xc]
call fcn.00402462
push dword [ebp - 0xc]
mov esi, eax
call fcn.0040106a
mov esi, eax
xor eax, eax
cmp esi, edi
setne al
push str.Unable_to_find_an_appended_archive.
mov dword [ebp - 0x14], esi
push eax
call fcn.00401000
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
push 5
add eax, dword [ebp - 8]
pop ecx
push dword [ebp - 0xc]
cdq
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov esi, eax
mov dword [ebp - 0x14], edx
call fcn.00401aa3
mov edi, dword [ebp + 8]
add esp, 0x2c
sub esi, dword [ebp - 0x1c]
sub esi, dword [ebp - 0x20]
sub esi, ebx
jns 0x4011e8
xor esi, esi
push 0
push esi
push dword [ebp - 4]
call fcn.00402941
push dword [ebp - 4]
push ebx
push 1
push edi
call fcn.00402462
mov esi, eax
xor eax, eax
cmp eax, esi
sbb eax, eax
neg eax
push str.Unable_to_read_from_file
push eax
call fcn.00401000
add esp, 0x24
lea eax, [esi + edi - 1]
pop esi
pop ebx
jmp 0x40122d
mov dx, word [eax]
mov ecx, 0x40fab0
cmp dx, word [ecx]
je 0x401233
dec eax
cmp eax, edi
jae 0x40121f
jmp 0x401236
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
call fcn.00402b9c
mov eax, dword [ebp - 0x10]
pop ecx
pop edi
leave
ret
Function at 0x41b000
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x40
lea eax, [esp + 0x44]
lea ecx, [esp]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
push esi
mov esi, dword [esp + 0x50]
push edi
push 0
push eax
push 0x40
push ecx
push esi
call ebx
test eax, eax
je 0x41b175
cmp dword [esp + 0x54], 0x40
jne 0x41b175
cmp word [esp + 0x10], 0x5a4d
jne 0x41b175
mov edx, dword [esp + 0x4c]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push edx
push esi
call ebp
cmp eax, 0xffffffff
je 0x41b175
lea eax, [esp + 0x54]
push 0
push eax
push pe_nt_image_headers32
push 0x421960
push esi
call ebx
test eax, eax
je 0x41b175
cmp dword [esp + 0x54], 0xf8
jne 0x41b175
cmp dword [0x421960], 0x4550
jne 0x41b175
mov eax, dword [0x421976]
test ah, 0x20
jne 0x41b175
mov edx, dword [0x421a80]
xor eax, eax
mov ax, word [0x421966]
add eax, edx
lea eax, [eax + eax*4]
shl eax, 3
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [0x421a58], eax
je 0x41b175
push 1
push 0
push 0
push esi
call ebp
mov dword [0x421a6c], eax
xor eax, eax
mov ax, word [0x421966]
mov edx, dword [0x421a58]
lea ecx, [esp + 0x54]
push 0
lea edi, [eax + eax*4]
push ecx
shl edi, 3
push edi
push edx
push esi
call ebx
test eax, eax
je 0x41b175
cmp dword [esp + 0x54], edi
jne 0x41b175
push 1
push 0
push 0
push esi
call ebp
mov ecx, dword [0x421a80]
lea ecx, [ecx + ecx*4]
lea edx, [eax + ecx*8]
mov eax, dword [0x4219b4]
cmp edx, eax
ja 0x41b175
mov edi, dword [0x421a58]
mov ecx, dword [0x421988]
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 0xc]
add eax, edx
cmp ecx, eax
jae 0x41b175
xor eax, eax
push 2
mov ax, word [0x421966]
push 0
push 0
push esi
lea ecx, [eax + eax*4]
mov ebx, dword [edi + ecx*8 - 0x18]
lea edi, [edi + ecx*8]
call ebp
mov edx, dword [edi - 0x14]
add edx, ebx
cmp eax, edx
jne 0x41b175
cmp dword [edi - 0x20], ebx
ja 0x41b175
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x40
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
Function at 0x41d769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x421190
cmp edx, dword [eax]
je 0x41d78b
add eax, 8
inc ecx
cmp eax, 0x421220
jl 0x41d77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x421190]
jne 0x41d8b9
mov eax, dword [0x421bb0]
cmp eax, 1
je 0x41d893
test eax, eax
jne 0x41d7bc
cmp dword [0x4210e4], 1
je 0x41d893
cmp edx, 0xfc
je 0x41d8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41d7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041e670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041e490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41d836
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041e490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42045c
push edi
call fcn.0041ef00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041e670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041e680
lea eax, [ebp - 0xa0]
push 0x42043c
push eax
call fcn.0041e680
push dword [esi + 0x421194]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041e680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041ee75
add esp, 0x2c
pop edi
jmp 0x41d8b9
lea eax, [ebp + 8]
lea esi, [esi + 0x421194]
push 0
push eax
push dword [esi]
call fcn.0041e490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40734a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4703f5
call fcn.0046ffb4
sub esp, 0x60
push ebx
push esi
xor esi, esi
cmp byte [0x5aeb6c], 0
push edi
jne 0x407468
push 0x2220
call dword [sym.imp.SDL2.dll_SDL_Init]
pop ecx
test eax, eax
je 0x4073da
call dword [sym.imp.SDL2.dll_SDL_GetError]
push dword [ebp - 0x18]
mov ebx, eax
push ecx
lea ecx, [ebp - 0x50]
call fcn.00412be6
push ecx
push 0x1a
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004123c9
mov edx, esi
mov cl, byte [edi + edx + 1]
lea eax, [ebp - 0x34]
xor cl, byte [edi]
cmp dword [ebp - 0x20], 0xf
cmova eax, dword [ebp - 0x34]
mov byte [eax + edx], cl
inc edx
cmp edx, 0x1a
jb 0x40739c
mov dword [ebp - 4], esi
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 0xf
push ebx
cmova eax, dword [ebp - 0x34]
push eax
call fcn.004504e4
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
call fcn.00412370
jmp 0x407468
push esi
call dword [sym.imp.SDL2.dll_SDL_GameControllerOpen]
mov dword [0x5ae708], eax
pop ecx
test eax, eax
jne 0x407449
call dword [sym.imp.SDL2.dll_SDL_GetError]
push dword [ebp - 0x18]
mov ebx, eax
push ecx
lea ecx, [ebp - 0x69]
call fcn.00412c92
push ecx
push 0x33
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004123c9
mov cl, byte [edi + esi + 1]
lea eax, [ebp - 0x34]
xor cl, byte [edi]
cmp dword [ebp - 0x20], 0xf
cmova eax, dword [ebp - 0x34]
mov byte [eax + esi], cl
inc esi
cmp esi, 0x33
jb 0x40740c
mov dword [ebp - 4], 1
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 0xf
push ebx
cmova eax, dword [ebp - 0x34]
push eax
call fcn.004504e4
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
call fcn.00412370
lea ecx, [ebp - 0x1c]
call fcn.00401dfc
mov byte [0x5aeb6c], 1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [0x5ae6a0], ecx
mov dword [0x5ae6a4], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x407c0b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov al, byte [0x5ae9ac]
sub esp, 0x10
push esi
push edi
mov edi, ecx
test al, al
jne 0x407c3b
mov eax, dword [edi]
push ecx
mov ecx, dword [eax*4 + 0x475ea0]
call fcn.00450bac
pop ecx
test al, al
je 0x407c90
mov byte [0x5ae9ac], 1
jmp 0x407c90
cmp al, 1
jne 0x407c90
push ecx
mov ecx, 0x4747d0
call fcn.00450bac
and dword [ebp - 4], 0
lea edx, [ebp - 8]
pop ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], 0x46
call fcn.00412e3b
mov ecx, eax
call fcn.004167bd
mov esi, 0x475bc8
push dword [esi]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x407c85
mov eax, dword [esi]
mov dword [edi], eax
mov byte [0x5ae9ac], 0
add esi, 4
cmp esi, 0x475ea0
jne 0x407c6d
pop edi
pop esi
leave
ret
Function at 0x409045
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
push esi
call fcn.00408c25
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
xor esi, esi
push esi
push esi
push 0x4747f0
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x409072
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push edi
push 0
push 2
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x22c], 0x22c
lea eax, [ebp - 0x22c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x409113
push esi
mov ecx, ebx
lea eax, [ebp - 0x208]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4090d6
test dx, dx
je 0x4090d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4090d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4090b0
xor eax, eax
jmp 0x4090db
sbb eax, eax
or eax, 1
test eax, eax
jne 0x409100
push dword [ebp - 0x224]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x22c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4090a8
pop esi
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
leave
ret
Function at 0x411a70
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x411a93
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x411b66
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x2c]
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x24], edi
test ecx, ecx
je 0x411ac0
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x411ac6
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x411b2e
jg 0x411add
test esi, esi
je 0x411b2e
test ecx, ecx
jl 0x411b28
jg 0x411ae7
test eax, eax
je 0x411b28
cmp edi, ecx
jg 0x411afb
jl 0x411af1
cmp esi, eax
jae 0x411afb
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov ebp, dword [esp + 0x2c]
push eax
push ebp
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov ecx, dword [esp + 0x10]
add ebp, ecx
sub esi, ecx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x411b32
mov ebp, dword [esp + 0x2c]
jmp 0x411b3c
mov ebp, dword [esp + 0x2c]
test edi, edi
jl 0x411b57
jg 0x411b3c
test esi, esi
je 0x411b57
cmp dword [ebx + 0x4c], 0
je 0x411b57
push dword [ebx + 0x4c]
push esi
push 1
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc