joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015ad
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x82607c]
jne 0x4015b7
repz ret
jmp fcn.00401eac

Function at 0x406e0c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x82607c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004044f4
and dword [ebp - 0x14], 0
cmp dword [0x828e8c], 0
mov dword [ebp - 0x18], eax
jne 0x406ebf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406f67
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406f67
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x828e8c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x828e90], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x828e94], eax
call edi
push eax
call esi
mov dword [0x828e9c], eax
test eax, eax
je 0x406ebf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x828e98], eax
mov eax, dword [0x828e98]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406f18
cmp dword [0x828e9c], ecx
je 0x406f18
push eax
call esi
push dword [0x828e9c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406f18
test ebx, ebx
je 0x406f18
call edi
test eax, eax
je 0x406f0f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406f0f
test byte [ebp - 8], 1
jne 0x406f18
or dword [ebp + 0x10], 0x200000
jmp 0x406f4b
mov eax, dword [0x828e90]
cmp eax, dword [ebp - 0x18]
je 0x406f4b
push eax
call esi
test eax, eax
je 0x406f4b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406f4b
mov eax, dword [0x828e94]
cmp eax, dword [ebp - 0x18]
je 0x406f4b
push eax
call esi
test eax, eax
je 0x406f4b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x828e8c]
call esi
test eax, eax
je 0x406f67
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406f69
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004015ad
leave
ret
Function at 0x421740
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1e000]
push edi
or ebp, 0xffffffff
jmp 0x421762
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x421769
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x421758
mov eax, 1
add ebx, ebx
jne 0x42177b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x421770
jne 0x42178c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421770
xor ecx, ecx
sub eax, 3
jb 0x4217a0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x421812
mov ebp, eax
add ebx, ebx
jne 0x4217ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4217b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4217dc
inc ecx
add ebx, ebx
jne 0x4217c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4217bd
jne 0x4217d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4217bd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4217fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4217ed
jmp 0x42175e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4217fc
add edi, ecx
jmp 0x42175e
pop esi
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x42185b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x211dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2122c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x421819
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x21234]
or eax, eax
je 0x421855
mov dword [ebx], eax
add ebx, 4
jmp 0x421836
call dword [esi + 0x21230]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x42188c
cmp al, 0xef
ja 0x42187f
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x421861
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x42186e
mov ebp, dword [esi + 0x21238]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4218c0
sub esp, 0xffffff80
jmp 0x411023
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x404740
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x40475f
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x40475a
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x404744
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x40474c
cmp edx, ebx
jne 0x40489a
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x40471b
add eax, dword [eax + 4]
jmp 0x404708
mov dword [ebp + 0xc], ebx
jmp 0x40476a

Function at 0x4047a0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x404782
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp fcn.004047a0
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4047fe
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4047e5
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4047ee
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4047f8
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4047da
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x404764
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40484b
dec eax
je 0x404842
sub eax, 3
je 0x404839
mov dword [ebp - 4], 0x40
jmp 0x404868
mov dword [ebp - 4], 4
jmp 0x40484e
mov dword [ebp - 4], 0x20
jmp 0x40484e
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40489a
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40481a
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004040ab
cmpsd dword [esi], dword es:[edi]
mov ebp, 0x75ff2092
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x4048a6
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404936
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ebp + 0x55fffffc], edi
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.004040bb
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00404070
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
invalid
invalid
jl 0x404971
Function at 0x406080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x37c], 0
jne 0x40608e
jmp 0x405a4d
cmp dword [ebp - 0x37c], 0
je 0x40609c
jmp 0x406151
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x4060f5
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x4060fa
jmp 0x405a4d
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x406141
lea eax, [ebp - 0x714]
push eax
call fcn.004040bb
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00404070
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x40614c
jmp 0x406151
jmp 0x405a4d
cmp dword [ebp - 0x37c], 0

Function at 0x406bd0
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x406c1b
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00406d6b
test al, al
jne 0x406c15
sub edx, 2
cmp edx, edi
jne 0x406bfb
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x406c3d
lea eax, [edi + 2]
cmp edx, eax
je 0x406c3d
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00406b1c
add esp, 0x10
jmp 0x406d37
push esi
lea ecx, [ebp - 0x255]
call fcn.00406d6b
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406c80
push dword [ebp - 0x25c]
jmp 0x406c2d
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x406cbd
cmp word [ebp - 0x226], 0
je 0x406cde
cmp word [ebp - 0x226], ax
jne 0x406cbd
cmp word [ebp - 0x224], 0
je 0x406cde
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00406b1c
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x406d2a
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x406c97
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x406d12
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x406d37
push 0x40694c
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00409870
add esp, 0x10
jmp 0x406d07
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040126a
leave
ret
Function at 0x40d5a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40d5cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d5cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x402793
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x4027a2
pop dword [ebp - 0x10]
mov eax, 0xf9a0db32
sub eax, 0xf960b390
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3639e
push 0
mov eax, 0x6516baab
add eax, 0x9b2a262d
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x8a7e9f3a
add ecx, 0x75819a62
mov esi, eax
mov edx, 0xa68013c3
add edx, 0x59c12801
add edx, dword [ebp - 0x10]
mov ebx, 0xf0cd35e7
xor dword [ebp - 8], edi
mov edi, dword [edx]
add dword [ebp - 8], esi
add edi, ebx
mov dword [esi], edi
xor dword [ebp - 0xc], ebx
add esi, 0x3e6f3414
sub esi, 0x3e6f3410
add edx, 0xfc06c5f3
add edx, 0x3f93a11
loop 0x4027fb
add eax, 0xf66acf41
add eax, 0x9960a02
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10895880
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10895a64
pushal
mov esi, section.UPX1
lea edi, [esi - 0x85c000]
push edi
or ebp, 0xffffffff
jmp 0x108958aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x108958b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x108958a0
mov eax, 1
add ebx, ebx
jne 0x108958c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x108958d4
jne 0x108958f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x108958f3
dec eax
add ebx, ebx
jne 0x108958e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x108958b8
add ebx, ebx
jne 0x108958ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10895945
xor ecx, ecx
sub eax, 3
jb 0x1089590b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1089597a
sar eax, 1
mov ebp, eax
jmp 0x10895916
add ebx, ebx
jne 0x10895916
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x108958e4
inc ecx
add ebx, ebx
jne 0x10895924
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x108958e4
add ebx, ebx
jne 0x10895931
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10895926
jne 0x10895942
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10895926
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10895964
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10895956
jmp 0x108958a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10895964
add edi, ecx
jmp 0x108958a6
pop esi
mov edi, esi
mov ecx, 0xeee
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10895982
cmp byte [edi], 0xa
jne 0x10895982
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10895987
lea edi, [esi + 0x891000]
mov eax, dword [edi]
or eax, eax
je 0x108959f6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x895468]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8954dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x108959b4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8954e0]
or eax, eax
je 0x108959f0
mov dword [ebx], eax
add ebx, 4
jmp 0x108959d1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10895a27
cmp al, 0xef
ja 0x10895a1a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x108959fc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10895a09
mov ebp, dword [esi + 0x8954e4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10895a5b
sub esp, 0xffffff80
jmp 0x10010226
Function at 0x100250d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100250e3
pop dword [ebp - 0x20]
mov eax, 0x2964add6
sub eax, 0x19625cf3
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xaa797420
add dword [ebp - 0x30], 0xa3d8d12b
mov dword [ebp - 0x2c], 0xcae7555f
sub dword [ebp - 0x2c], 0x98b4091a
mov dword [ebp - 0x28], 0x3e08e73c
sub dword [ebp - 0x28], 0xf1bca30e
mov dword [ebp - 0x24], 0xad1042b7
sub dword [ebp - 0x24], 0xad1042b7
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x6669cf36
sub dword [ebp - 0x30], 0xf1f765e0
mov dword [ebp - 0x2c], 0xe0c7dc8b
sub dword [ebp - 0x2c], 0x9f5b7b16
mov dword [ebp - 0x28], 0xf593ea92
add dword [ebp - 0x28], 0x6ddb81da
mov dword [ebp - 0x24], 0x131f97f9
add dword [ebp - 0x24], 0xece06807
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3d95a
push 0
call eax
mov ecx, 0x5bbd26db
sub ecx, 0x5bbcd4d8
mov edi, eax
mov esi, 0x10088400
add esi, dword [ebp - 0x20]
mov ebx, 0x99a4b197
mov dword [ebp - 0x10], 0x548633a9
mov edx, dword [esi]
mov dword [ebp - 0x10], 0x2dfdd52c
xor edx, ebx
sub dword [ebp - 0x18], ecx
mov dword [edi], edx
add dword [ebp - 4], edi
add edi, 0xe28d52fd
sub edi, 0xe28d52f9
add esi, 4
loop 0x100251ef
add eax, 0x4ca2846b
sub eax, 0x4ca1498c
mov ebx, eax
add eax, 0xf81b0890
sub eax, 0xf81b088b
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x40160d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43e07c]
jne 0x401617
repz ret
jmp fcn.00401f23

Function at 0x406b4c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43e07c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004044cb
and dword [ebp - 0x14], 0
cmp dword [0x440a58], 0
mov dword [ebp - 0x18], eax
jne 0x406bff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406ca7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406ca7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x440a58], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x440a5c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x440a60], eax
call edi
push eax
call esi
mov dword [0x440a68], eax
test eax, eax
je 0x406bff
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x440a64], eax
mov eax, dword [0x440a64]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406c58
cmp dword [0x440a68], ecx
je 0x406c58
push eax
call esi
push dword [0x440a68]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406c58
test ebx, ebx
je 0x406c58
call edi
test eax, eax
je 0x406c4f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406c4f
test byte [ebp - 8], 1
jne 0x406c58
or dword [ebp + 0x10], 0x200000
jmp 0x406c8b
mov eax, dword [0x440a5c]
cmp eax, dword [ebp - 0x18]
je 0x406c8b
push eax
call esi
test eax, eax
je 0x406c8b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406c8b
mov eax, dword [0x440a60]
cmp eax, dword [ebp - 0x18]
je 0x406c8b
push eax
call esi
test eax, eax
je 0x406c8b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x440a58]
call esi
test eax, eax
je 0x406ca7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406ca9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040160d
leave
ret
Function at 0x403b52
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffadc
push esi
lea esi, [esp + 0x40]
mov dword [esi], 0x4f4c45
mov dword [esi + 4], 0
push esi
call dword [sym.imp.USER32.dll_CharLowerA]
cmp dword [esi], 0x6f6c65
jne 0x403b83
cmp eax, esi
je 0x403b84
leave
ret 4
add byte [ebx - 0x17a7dbcc], cl
sbb byte [eax], al
add byte [eax], al
mov esi, dword [esp]
pop eax
call fcn.00403ba5
cmp eax, 0
je 0x403b9c
cmp edx, eax
jbe 0x403bb3
jmp eax
push eax
notrack jmp dword ds:[sym.imp.KERNEL32.dll_LeaveCriticalSection]
in al, 0x10
inc ebx
add byte [ebx], ah
lds eax, [eax + 0x3b]
les esp, [esi]
jp 0x403bc2
call dword es:[sym.imp.USER32.dll_GetKeyState]
dec eax
mov esp, 0x48004310
and eax, 0x7ffe
sub ax, 0x7ffc
xchg ecx, eax
push ecx
ror dword [esp], 4
rol dword [esp], 7
pop ecx
xchg ecx, eax
call dword cs:[eax*4 + sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
dec eax
and eax, 6
lea eax, [eax*2 - 0x5b]
mov edx, 0x40ccb2
add eax, edx
je 0x403bc2
ret

Function at 0x403ba5
Capabilities:
Log keystrokes via polling

Disassembly:
push esp
push 0
mov eax, ebp
push 0
push 0
push 0xffffffffffffffff
call dword es:[sym.imp.GDI32.dll_EnumICMProfilesA]
and eax, ebp
inc eax
cmp eax, esp
jp 0x403bc2