joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406330
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41325b
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x41d034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x144]
push 0
push eax
call fcn.004069d0
add esp, 8
cmp byte [0x41d919], 0
mov dword [ebp - 4], 0
je 0x406455
push 0x103
lea eax, [ebp - 0x113]
mov byte [ebp - 0x114], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [esi + 0x14], 0x10
jb 0x4063c0
mov ecx, dword [esi]
jmp 0x4063c2
mov ecx, esi
cmp dword [ebp - 0x130], 0x10
lea eax, [ebp - 0x144]
push ecx
cmovae eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x12c]
push str.__d._d._s._s___s_n
push eax
call fcn.00406fe0
add esp, 0x1c
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x118], 0x10
cmovae eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0x118], 0x10
jb 0x40643a
push dword [ebp - 0x12c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
mov eax, dword [0x41d920]
test eax, eax
jne 0x406485
push 0x18
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [0x41d920], eax
xorps xmm0, xmm0
movdqu xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x41d920]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.0040d150
lea ecx, [ebp - 0x144]
push ecx
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
test eax, eax
jne 0x4064af
push eax
push eax
call fcn.00405f80
add esp, 8
push dword [0x41d920]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0040d150
cmp dword [esi + 0x10], 0
mov edi, eax
je case.default.0x4064dd
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0xc]
call edx
mov ecx, dword [ebp + 8]
cmp ecx, eax
jg case.default.0x4064dd
cmp ecx, 3
ja case.default.0x4064dd
jmp dword [ecx*4 + 0x40653c]
push esi
mov ecx, edi
call fcn.0040cc20
jmp case.default.0x4064dd
push esi
mov ecx, edi
call fcn.0040d220
jmp case.default.0x4064dd
push esi
mov ecx, edi
call fcn.0040d6f0
jmp case.default.0x4064dd
push esi
mov ecx, edi
call fcn.0040cf60
cmp dword [ebp - 0x130], 0x10
jb 0x406521
push dword [ebp - 0x144]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004122f2
mov esp, ebp
pop ebp
ret
Function at 0x406dd0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413360
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x41d034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.00407950
add esp, 4
cmp dword [ebp + 0x18], 0
jle 0x406fac
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.004014d0
call fcn.00407210
add esp, 0x18
test al, al
je 0x406e4f
mov bl, 1
jmp 0x406fae
call fcn.00407580
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004034f0
mov esi, eax
add esp, 0xc
lea eax, [ebp + 8]
cmp eax, esi
je 0x406e9c
cmp dword [ebp + 0x1c], 8
jb 0x406e7f
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
call fcn.00402db0
cmp dword [ebp - 0x14], 8
jb 0x406ead
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
lea eax, [ebp + 8]
push eax
call fcn.00407420
mov ecx, dword [ebp + 0x18]
mov esi, 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 4
cmp ecx, esi
jbe 0x406f5d
cmp ecx, esi
jbe 0x406fa1
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
cmp word [eax + esi*2], 0x5c
jne 0x406f54
push esi
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 8]
call fcn.004028d0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.004014d0
call fcn.00407210
add esp, 0x18
test al, al
jne 0x406f3c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call edi
cmp dword [ebp - 0x14], 8
mov byte [ebp - 4], 0
jb 0x406f51
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp + 0x18]
inc esi
cmp ecx, esi
ja 0x406ed7
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call edi
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.004014d0
call fcn.00407210
add esp, 0x18
test al, al
je 0x406fac
mov bl, 1
jmp 0x406fae
push str.invalid_string_position
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xout_of_range_char_const__]
xor bl, bl
cmp dword [ebp + 0x1c], 8
jb 0x406fbf
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004122f2
mov esp, ebp
pop ebp
ret
Function at 0x407210
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4133f8
mov eax, dword fs:[0]
push eax
push ebx
mov eax, dword [0x41d034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.00407420
add esp, 4
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 8
jb 0x40726e
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40fb00
Capabilities:
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414099
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41d034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0xffffffffffffffff
push 0
push dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
call fcn.00401cc0
push 0xffffffffffffffff
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0xf
push 0
push dword [ebp + 0xc]
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00401cc0
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov dword [ecx + 0x14], 0xf
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00401cc0
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x48], eax
lea eax, [esi + 0x4c]
push eax
mov byte [ebp - 4], 2
call fcn.004121a0
add esp, 4
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 3
call fcn.00411f20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x411a00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push dword [0x41da14]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x411a54
push esi
push 0x10
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x411a2a
mov ecx, eax
call fcn.004111c0
mov esi, eax
jmp 0x411a2c
xor esi, esi
push dword [0x41da14]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x411a44
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push esi
push dword [0x41da14]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
ret
Function at 0x417c10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417c36
mov eax, dword [0x6357e0]
test eax, eax
je 0x417c2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6357e0], eax
test eax, eax
pop ebx
je 0x417cd1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov ecx, dword [0x6357e0]
push str.DirectSoundEnumerateA
push ecx
mov dword [0x6357dc], eax
call esi
mov ecx, dword [0x6357dc]
mov dword [0x6357e4], eax
test ecx, ecx
je 0x417cc7
test eax, eax
je 0x417cc7
mov eax, 1
pop esi
add esp, 0x50
ret
mov dword [0x6357e0], 0
xor eax, eax
pop esi
add esp, 0x50
ret

Function at 0x42af14
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0x84
and cl, bl
sar dword [edi], 0xb7
bound edx, qword [esi]
aas
mov bh, 0x62
push ss
lodsd eax, dword [esi]
xor cl, ah
xor bh, ch
cmp ebx, dword [ebp + 0xc]
pop es
lodsd eax, dword [esi]
out 0x4f, eax
sub dword [ebp + 0x791114b1], edi
mov bh, 0x35
jae 0x42ae00
sub byte [ecx + 0x60d51bd4], bh
fnop
inc esi
cmp al, 0x73
cli
invalid
jmp 0x42ae05
sbb ebp, dword [esp + ebp*4]
cmc
mov ebp, 0x88c73529
mov al, byte [0x8ff28b1]
adc al, 0x4b
jb 0x42ae70
leave
add eax, 0x97d93a27
invalid
jno 0x42ae81
mov bl, 0xec
or dh, 0xa1
salc
sub bl, 0x96
stc
call [ecx + 0x16124339]
loop 0x42ae84
cmp ch, byte [eax + 3]
salc
jl 0x42af25
ret
jnp 0x42aee9
out 0x1c, eax
pop ecx
adc ecx, dword [edx + 0x1a]
std
lcall 0x2f29, 0x6385f027
lodsd eax, dword [esi]
push ss
push esp
test ebp, edi
xor ah, byte [bp + di]
xchg esp, eax
insb byte es:[edi], dx
mov dh, 0xe4
int 0x42
Function at 0x4347c0
Capabilities:
Encode data using xor

Disassembly:
jne 0x4347ca
lea ecx, [eax]
push eax
call fcn.004383c0
add dword [ecx], 0
add byte [ecx + 0x174c3e38], ah
add byte [ebx - 0x5effffff], al
cmp byte [esi], bh
dec esp
pop ss
add al, al
mov ebx, dword [ebp - 0x10]
jne 0x434815
push 1
add byte [ecx], dl
dec ebx
add eax, 0x928500
je 0x43480e
fld dword [0x14b09f0]
add ah, ch
or al, 0xd9
pop esp
and al, 0xd8
add byte [0x4b09ec], al
fstp dword [ecx + eax]
fld dword [0xde4b09e8]
add byte [esp], bl
call fcn.0043b30c
add dword [eax], eax
xor eax, eax
mov dword [0xf93e38], eax
mov ecx, ebx
mov esi, eax
call fcn.0044bb5f
mov ecx, dword [esi]
test ecx, ecx
mov eax, dword [edx - 0x2dccc700]
div dword [esi + 8]
mov eax, dword [ecx]
add bl, ch
pop ss
cmp dword [esi + 0x28], edi
push esp
add byte [ebx - 0x17afacfa], cl
xor dl, byte [edi + 1]
add byte [ebp + 0x745959c0], al
aaa
add byte [esi + 0x24], dh
test esi, esi
jne 0x434830
test dword [ecx], eax
add byte [eax], dl
mov eax, dword [ebp - 0x10]
or dword [eax + eax], 0xffffffe8
imul eax, dword [edi + 0x468d0000], 1
add byte [0x83f0458b], cl
push 0
call fcn.0043cfc5
xor eax, eax
add dword [eax], eax
xlatb
add eax, 0xedb8c300
add byte [edx], cl
ret

Function at 0x45b9b9
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x45ba03
push esp
pop ebp
and dword [ecx + 0x3ab85c92], esi
pop esp
mov eax, 0x7b27ce3a
jno 0x45ba24
into
daa
jnp 0x45b9f6
jno 0x45ba24
fdivr dword [eax]
sti
scasb al, byte es:[edi]
mov al, pe_nt_image_headers32
movsb byte es:[edi], byte [esi]
inc edi
movsb byte es:[edi], byte [esi]
mov bh, 0x76
fadd qword [esi - 0x46]
js 0x45b9c1
sub byte [edi], dl
ror byte [eax - 0x18], 1
sbb eax, 0x7879f4eb
loop 0x45b9c4
xchg byte [edx], bh
popal
dec ecx
cmp al, 0xb7
xchg esp, eax
and byte [esi - 0x1c2d19c4], cl
pop edx
xor dword [ecx - 0x28], ebp
mov ebp, esp
sub edi, ebx
adc dword [ebx - 0xd], 2
retf 0xf458
fmul dword [ecx - 0x7c04d41b]
push ebx
add cl, dl
pop eax
hlt
sbb edx, dword [edi + 0x2f]
push edi
das
mov byte [0xa15f5bce], al
cmp dword [ebx + 0x212f32f8], edi
movsb byte es:[edi], byte [esi]
mov byte [0xf3bca837], al
jns 0x45ba56
mov ah, 0x9c
pop esi
fst qword [eax]
and al, bh
nop
cmc
xchg ebp, eax
mov edi, 0x9389fae0
xchg edi, eax
cmp cl, byte [edx + ebp]
loopne 0x45ba20
mov dword [ebx + 0x2a0c3a97], edx
enter 0xffffffffffffcdd9, 0x31
movsd dword es:[edi], dword [esi]
scasb al, byte es:[edi]
xor byte [edi - 0x25], ch
xchg dword [edi + edi*2 - 0x3a], esp
inc esi
xor dword [edi], 0x72
js 0x45ba04
sti
ret
lodsb al, byte [esi]
js 0x45ba7a
imul eax, dword [esi + ecx*2 - 0x7da66a30], 0xd5ada7c5
mov eax, dword [0x71a4c5f7]
pop eax
sbb eax, 0xab8bb950
mov esp, 0x3c66b105
mov cl, 0x20
inc esp
add ebx, dword [edx]
test dword [ebp - 0x74862567], 0x2e3c8af8
test dword [ecx - 0x7748626], ebx
mov bh, byte [esi + ebp]
sbb dl, byte [ebp + 0xa]
fiadd dword [esi + 0x46]
pop ss
adc al, 0x7c
pop ebx
xchg byte [eax + eax*4 + 0x7f51b94a], dl
adc eax, 0x29f2551a
nop
jmp 0x45bae1
invalid
Function at 0x462060
Capabilities:
Encode data using xor

Disassembly:
jne 0x46206a
lea ecx, [eax]
push eax
call int.00465c60
add dword [ecx], 0
add byte [ecx + 0x174c3e38], ah
add byte [ebx - 0x5effffff], al
cmp byte [esi], bh
dec esp
pop ss
add al, al
mov ebx, dword [ebp - 0x10]
jne 0x4620b5
push 1
add byte [ecx], dl
dec ebx
add eax, 0x928500
je 0x4620ae
fld dword [0x14b09f0]
add ah, ch
or al, 0xd9
pop esp
and al, 0xd8
add byte [0x4b09ec], al
fstp dword [ecx + eax]
fld dword [0xde4b09e8]
add byte [esp], bl
call fcn.00468bac
add dword [eax], eax
xor eax, eax
mov dword [0xf93e38], eax
mov ecx, ebx
mov esi, eax
call fcn.004793ff
mov ecx, dword [esi]
test ecx, ecx
mov eax, dword [edx - 0x2dccc700]

Function at 0x47cc60
Capabilities:
Encode data using xor

Disassembly:
dec esi
push eax
mov eax, dword [0xfabb6d69]
mov dword [eax + edx + 5], ebp
cmp bh, bl
fistp dword [ebp + 0x1545cbc2]
pop edx
mov byte [ebp - 0x2a22a3ad], cl
dec ebx
test dh, cl
pop ds
xchg edx, eax
add ebp, dword [eax + 0x6a]
push es
lds edi, [ebp + 0x6dab2de4]
out dx, eax
nop
xor edi, edx
pop ebp
adc al, 0x7b
mov word [edx - 0x21], ds
pop ebx
xchg ecx, eax
fidivr word [esi - 0x1a16ca6d]
fisttp word [ecx - 0x2a654606]
dec ebx
or bh, byte [edi]
cmp bl, ah
fnstsw word [ebx - 0x4f168007]
enter 0xffffffffffff9ebb, 0x49
cwde
jno 0x47cc8b
pop esi
stosd dword es:[edi], eax
cld
mov eax, 0x959b4f58
int1
push eax
retf 0xfb9d

Function at 0x490aa0
Capabilities:
Encode data using xor

Disassembly:
jne 0x490aaa
lea ecx, [eax]
push eax
call fcn.004946a0
add dword [ecx], 0
add byte [ecx + 0x174c3e38], ah
add byte [ebx - 0x5effffff], al
cmp byte [esi], bh
dec esp
pop ss
add al, al
mov ebx, dword [ebp - 0x10]
jne 0x490af5
push 1
add byte [ecx], dl
dec ebx
add eax, 0x928500
je 0x490aee
fld dword [0x14b09f0]
add ah, ch
or al, 0xd9
pop esp
and al, 0xd8
add byte [0x4b09ec], al
fstp dword [ecx + eax]
fld dword [0xde4b09e8]
add byte [esp], bl
call fcn.004975ec
add dword [eax], eax
xor eax, eax
mov dword [0xf93e38], eax
mov ecx, ebx
mov esi, eax
call fcn.004a7e3f
mov ecx, dword [esi]
test ecx, ecx
mov eax, dword [edx - 0x2dccc700]
div dword [esi + 8]
mov eax, dword [ecx]
add bl, ch
pop ss
cmp dword [esi + 0x28], edi
push esp
add byte [ebx - 0x17afacfa], cl
xor dl, byte [edi + 1]
add byte [ebp + 0x745959c0], al
aaa
add byte [esi + 0x24], dh
test esi, esi
jne 0x490b10
test dword [ecx], eax
add byte [eax], dl
mov eax, dword [ebp - 0x10]
or dword [eax + eax], 0xffffffe8
imul eax, dword [edi + 0x468d0000], 1
add byte [0x83f0458b], cl
push 0
call fcn.004992a5
xor eax, eax
add dword [eax], eax
xlatb
add eax, 0xedb8c300
add byte [edx], cl
ret
Function at 0x4a7b80
Capabilities:
Encode data using xor

Disassembly:
jne 0x4a7b8a
lea ecx, [eax]
push eax
call fcn.004ab780
add dword [ecx], 0
add byte [ecx + 0x174c3e38], ah
add byte [ebx - 0x5effffff], al
cmp byte [esi], bh
dec esp
pop ss
add al, al
mov ebx, dword [ebp - 0x10]
jne 0x4a7bd5
push 1
add byte [ecx], dl
dec ebx
add eax, 0x928500
je 0x4a7bce
fld dword [0x14b09f0]
add ah, ch
or al, 0xd9
pop esp
and al, 0xd8
add byte [0x4b09ec], al
fstp dword [ecx + eax]
fld dword [0xde4b09e8]
add byte [esp], bl
call fcn.004ae6cc
add dword [eax], eax
xor eax, eax
mov dword [0xf93e38], eax
mov ecx, ebx
mov esi, eax
call 0x4bef1f
mov ecx, dword [esi]
test ecx, ecx
mov eax, dword [edx - 0x2dccc700]
div dword [esi + 8]
mov eax, dword [ecx]
add bl, ch
pop ss
cmp dword [esi + 0x28], edi
push esp
add byte [ebx - 0x17afacfa], cl
xor dl, byte [edi + 1]
add byte [ebp + 0x745959c0], al
aaa
add byte [esi + 0x24], dh
test esi, esi
jne 0x4a7bf0
test dword [ecx], eax
add byte [eax], dl
mov eax, dword [ebp - 0x10]
or dword [eax + eax], 0xffffffe8
imul eax, dword [edi + 0x468d0000], 1
add byte [0x83f0458b], cl
push 0
call fcn.004b0385
xor eax, eax
add dword [eax], eax
xlatb
add eax, 0xedb8c300
add byte [edx], cl
ret

Function at 0x4b49d1
Capabilities:
Encode data using xor

Disassembly:
fist dword [ecx]
and dword [edx - 0x3a], eax
xchg esp, eax
sal dword [esi - 0x79], 1
add edx, dword [ebp + 0x108a3b87]
xchg ebp, eax
xchg dword [ebx], edi
mov dl, byte [eax]
sar dword [edx + 0x63], 1
dec ebp
pop esi
cmp al, 0xe8
stosb byte es:[edi], al
pop edx
xchg edi, eax
push 0x6bc43a4
mov bh, 0xb4
add ebp, dword [eax + 0x2dbb8a3d]
xor bl, 0x8a
enter 0xffffffffffffea22, 0x11
pop ecx
lahf
sbb byte [eax], 0xd2
pop ss
lodsb al, byte [esi]
sahf
mov ah, 0x7b
or edi, dword [esi - 0x73688619]
fcomp dword [ecx + 0x114d9770]
js 0x4b49f7
xor eax, 0x98e3f101
cwde
fsub qword [eax - 0x5b]
mov word [ebp + 0x7c], fs
jmp 0x4b49db
Function at 0x628d85
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6323b0
cmp edx, dword [eax]
je 0x628da7
add eax, 8
inc ecx
cmp eax, 0x632440
jl 0x628d98
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6323b0]
jne 0x628ed5
mov eax, dword [0x636d8c]
cmp eax, 1
je 0x628eaf
test eax, eax
jne 0x628dd8
cmp dword [0x6322dc], 1
je 0x628eaf
cmp edx, 0xfc
je 0x628ed5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x628e0f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629770
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629c00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628e52
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629c00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ea6c
push edi
call fcn.0062bad0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629770
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629780
lea eax, [ebp - 0xa0]
push 0x62ea4c
push eax
call fcn.00629780
push dword [esi + 0x6323b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629780
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062ba44
add esp, 0x2c
pop edi
jmp 0x628ed5
lea eax, [ebp + 8]
lea esi, [esi + 0x6323b4]
push 0
push eax
push dword [esi]
call fcn.00629c00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401f21
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
xor edx, edx
xor ebx, ebx
push esi
inc ebx
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], edx
cmp dword [eax + 4], edx
je 0x473a1b
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov byte [eax], dl
mov eax, dword [ebp + 0x10]
mov byte [ecx], dl
mov ecx, dword [ebp + 0x14]
mov dword [edi], edx
mov byte [ecx], dl
mov byte [eax], dl
mov dword [ebp - 0xc], 0x2b
mov dword [ebp - 8], 0x23
mov edi, edx
push edi
mov ecx, esi
call fcn.00402086
movzx eax, word [eax]
push 0x2b
pop ecx
push 0x5e
cmp ax, cx
pop ecx
push 0x21
pop edx
je 0x473a22
cmp ax, cx
je 0x473a22
cmp ax, dx
je 0x473a22
cmp ax, word [ebp - 8]
je 0x473a22
push edi
inc edi
mov ecx, esi
mov dword [ebp + 0x1c], edi
call fcn.00402086
movzx eax, word [eax]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
cmp eax, 0x7b
jne 0x473a9d
push 0x40
lea ecx, [ebp - 0x20]
call fcn.00406b0f
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x7d
call fcn.00402036
test al, al
je 0x402032
push dword [ebp - 0x20]
push dword [esi*4 + 0x4bb5d0]
call fcn.00420fa7
pop ecx
pop ecx
test eax, eax
je 0x402000
inc esi
cmp esi, 0x62
jl 0x401fe5
cmp esi, 0x62
je 0x473a54
cmp byte [esi + 0x4bb568], 0
jne 0x402032
movzx eax, byte [esi + str._f_b_b..__reepqrstuvwxyz________t___]
mov dword [edi], eax
lea ecx, [ebp - 0x20]
call fcn.0040cb37
and dword [edi], 0xff
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x18
xor bl, bl
jmp 0x40201b
lea ecx, [ebp - 0x20]
call fcn.0040cb37
xor al, al
jmp 0x40202b
cmp ax, word [ebp - 0xc]
jne 0x473a2d
mov eax, dword [ebp + 0x10]
jmp 0x473a4c
cmp ax, cx
jne 0x473a37
mov eax, dword [ebp + 0x14]
jmp 0x473a4c
cmp ax, dx
jne 0x473a41
mov eax, dword [ebp + 0x18]
jmp 0x473a4c
push 0x23
pop ecx
cmp ax, cx
jne 0x473a4e
mov eax, dword [ebp + 0x1c]
mov byte [eax], bl
inc edi
jmp 0x401f6d
push 0
lea ecx, [ebp - 0x20]
call fcn.004061a6
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x473a13
test eax, 0x200
je 0x473a7c
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x473a88
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x40201b
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0x40201b
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x473a1b
test eax, 0x200
je 0x473abc
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x473ac8
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x402023
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0x402023
Function at 0x4027ec
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push edi
mov edi, ecx
push 5
pop eax
xor ebx, ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
push ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret