joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40953c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x409589
xor ebx, ebx
jmp 0x40957e
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
jmp 0x414540
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x40955f
mov al, byte [ebp - 1]
sub al, 1
jb 0x409594
je 0x40959d
jmp 0x4095a6
call fcn.00407024
mov edi, eax
jmp 0x4095a8
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x4095a8
xor edi, edi
test di, di
je 0x409639
xor ebx, ebx
jmp 0x4095e4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x4095e3
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4095d8
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x4095e3
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409639
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4095b5
xor ebx, ebx
jmp 0x40962e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x40962d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x409622
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x40962d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409639
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4095f3
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
jmp 0x4194e0
Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
jmp 0x41b540
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x409bec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push 0xa
push 0x2b67
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
jne 0x409c06
call fcn.00409aa0
push ebx
push 0
call sub.kernel32.dll_SizeofResource
cmp eax, 0x2c
je 0x409c18
call fcn.00409aa0
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x409c2b
call fcn.00409aa0
push ebx
jmp 0x41b380
Function at 0x417e10
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
mov esi, 0x190
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000001
mov edi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417ee7
lea ecx, [esp + 0x24]
push ebp
mov ebp, 4
push ecx
push ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esp + 0x24], eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.Browse_For_Folder_Width
push edx
call ebx
test eax, eax
jne 0x417e94
mov edi, dword [esp + 0x1c]
xor esi, esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.Browse_For_Folder_Height
push eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebp
call ebx
test eax, eax
pop ebp
jne 0x417ec2
or esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x417edc
mov ecx, dword [0x4c7b4c]
push 0x4c783c
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x4210ca
Capabilities:
Encrypt data using rc4 prga

Disassembly:
aas
invalid
jns 0x4210eb
sub bh, byte [edi - 0x52]
pop edi
insb byte es:[edi], dx
das
invalid
add byte cs:[ebx + ebp*8], al
mov dword [0x4f464f29], eax
add dl, dh
insb byte es:[edi], dx
jl 0x4210ee
jmp 0x421093
sbb byte [edi], ch
mov bh, 0x62
mov bh, 0xf8
pop edi
xor ebx, edi
fld xword [ecx]
inc esp
cld
wait
neg ah
Function at 0x44250b
Capabilities:
Encode data using xor

Disassembly:
pop eax
out dx, eax
salc
xlatb
push esi
lcall 0xf40b, 0x14c50f03
ja 0x442597
xchg ebx, eax
call dword [ebp + 0x27]
neg byte [ebx - 0x62fb2d35]
pop ebp
into
and al, 0xab
lcall 0xc1c1, 0xd43c1d26
mov eax, 0xa90a8330
invalid
or byte [ecx + 0x29], al
mov gs, word [0x52d9b215]
push edx
ja 0x4425ec
push ss
adc al, 0xdc
cmp eax, eax
jp 0x442605
popfd
inc eax
mov ecx, 0x3c6935c1
cmpsd dword [esi], dword es:[edi]
out dx, eax
sub dword [eax], ebx
pop eax
jg 0x44259f
lds ecx, [edi - 0x63]
sub al, 0x7a
dec ebx
adc al, 0xf
push cs
cmp dword [ebp + 0x32], edx
adc dl, dh
enter 0xffffffffffffbf3e, 0xffffffffffffff97
cwde
xor al, 0xb9
cmp eax, 0x1c5ae41a
or esi, eax
ror dword [edx], cl
sahf
popfd
test byte [esi + 0x1c], al
sal edx, 1
cmp dword [ebx], 0x61
mov dword [0xeca7941f], eax
nop
adc esi, dword [edx - 0x63]
adc dword [ecx + edi - 0xb7cdd28], edi
ficom dword [edx]
lodsd eax, dword [esi]
and al, byte [ebx - 0x52ed250c]
lcall 0xbc66, 0xb4b33e35
invalid
jecxz 0x442634
sbb esi, esi
cmp dword [esi + 0x411199fc], esp
and dword [eax - 0x4b], ecx
jmp 0x44262b
inc esp
sal ch, 0xbc
stosb byte es:[edi], al
xchg dword [0x1649e051], edx
dec ecx
push ss
xor dword [edx + 0x65cb3d57], 0xffffffd4
in eax, dx
inc edx
sub eax, 0xe8008214
sbb al, byte [esi + 0x25]
mov cl, 0xc5
inc ecx
sbb eax, 0xe47f601b
cli
sub byte [edi], dh
xor esi, esp
ret 0xd8c2

Function at 0x46d3c7
Capabilities:
Encode data using xor

Disassembly:
jae 0x46d421
mov esi, 0x655b14cd
daa
lea esi, [ebp + 0x7d84a216]
mov al, 0x65
invalid
mov ah, 0xe6
adc eax, 0xd52e24af
cmpsb byte [esi], byte es:[edi]
mov ch, 0x93
and dword [ebx], 0x7017da92
mov ch, 0xb1
dec ebx
cmp dword [eax], 0x5c241b1a
xchg dl, dh
mov bl, 0xc2
xor dword [edx - 0x15793c0c], eax
in al, dx
imul esp, dword [edx - 0x5d], 0x31863f30
insb byte es:[edi], dx
fdiv qword [edi - 0x683cc6e]
push edx
mov bh, 0x92
xor edi, dword [ecx + edi*8 + 0x52]
bound esi, qword fs:[ecx + 0x17]
fadd dword [ecx - 0x7313d34a]
loop 0x46d434
sub dword [ecx - 0x1beb6e1d], 0x11
sal byte [esi + 0x51], 0xbe
mov dword [ecx - 0x2b], eax
jo 0x46d481
push eax
push edx
add byte [ebx], dh
push ds
div esi
pushal
mov dword [0x4c96894b], eax
push 0x88ec5e27
and eax, 0x7c2dd976
mul byte [eax - 0x5d]
dec ebx
mov dword [esi + 0x5e27684c], edx
in al, dx
mov byte [0x7c2dd976], ah
pop eax
mov dl, 0x86
dec ebx
loopne 0x46d4fe
sal byte [edi - 0x6dee3eb0], cl
dec ecx
test eax, 0x834aa8be
mov al, byte [0x6762d68]
inc esi
jl 0x46d44e
push 0x6ca0e4e9
add ch, bh
pushfd
jle 0x46d477
dec esi
invalid
cmpsb byte [esi], byte es:[edi]
sbb dword [esi - 1], edx
mov ebp, 0x67429966
dec eax
sbb cl, dh
invalid
Function at 0x47d23a
Capabilities:
Encode data using xor

Disassembly:
je 0x47d28b
jbe 0x47d29a
sti
pop edi
int1
retf 0x454b
cmp eax, dword [eax + 0x7b429858]
outsb dx, byte [esi]
inc edx
jnp 0x47d300
lodsd eax, dword [esi]
outsd dx, dword [esi]
outsb dx, byte [esi]
xchg edi, eax
imul ecx, dword [eax], 0x5cff1e4e
jne 0x47d28f
dec esi
push ds
call [ebp + esi*2 - 0xf]
pushal
jle 0x47d2e1
xor byte [esi], bh
outsw dx, word [esi]
xchg edx, eax
in al, 0x4a
jg 0x47d295
jo 0x47d2f7
aaa
cmpsd dword ss:[esi], dword es:[edi]
pop ebp
jo 0x47d2a1
pop ebp
cwde
sar dword ss:[ebp - 0x4a1815a], 1
inc ebx
inc esi
in eax, dx
loop 0x47d298
sub byte [ecx + 0x37], dl
inc esi
mov al, byte [0x3136e01e]
xchg esi, eax
mov ebp, 0x5318fdc7
or dl, byte [ecx - 0x64]
nop
push edi
cwde
push edi
or eax, 0x45ca2b41
rcr dword [esi], 0x9e
jb 0x47d330
dec esi
inc eax
or dword [ecx + 4], ecx
push ebx
mov dh, 0x36
das
jo 0x47d325
mov ah, byte [esi + 0x65]
pop edi
inc ebx
inc edx
jae 0x47d358
jle 0x47d367
dec eax
xchg ebp, eax
retf 0x740d
sahf
sbb ecx, eax
sbb byte [eax + 0x55bc55cc], 0x5b
imul ebp, dword [eax + esi*2 + 0x5e], 0x7ce24ee0
cmc
sub dl, byte [ecx + 0x6e]
insb byte es:[edi], dx
dec edx
xor dword [edi + 0xe653097], ecx
ret 0xd95
nop
inc edx
adc edx, edi
push ds
jge 0x47d39d
push 0xcb81c7c7
push ebp
imul eax, edi, 0x13df0397
and cl, ch
inc esi
retf
call 0x1507d368
jl 0x47d33b
sub dword [ebx], eax
in eax, 3
adc al, 0x20
add dword [eax + 0x91b05fd], eax
inc esi
mov ch, 0x92
jo 0x47d371
pop ecx
jmp 0x5024645f
fmul qword [edi - 0x6b]
jae 0x47d3ab
sahf
inc esi
sbb cl, ch
push ebp
leave
push ss
insd dword es:[edi], dx
js 0x47d3cb
arpl dx, dx
adc ch, byte [eax]
push esi
clc
sbb byte [edi], dl
rcl byte [edx], cl
push 0x18f85600
pop ss
push ebx
pop eax
cmc
or byte [eax], 0x44
sub eax, 0xdf70e5bf
push ds
invalid
or al, 0x7a
inc esp
adc eax, 0x1271bd8c
and eax, 0x40081b55
add byte [edx + 0x492a4701], dl
xchg edx, eax
add dword [edi + 0x2a], eax
dec ecx
or byte [ebx + 0x41c13466], 0x28
nop
or al, 0x10
mov ecx, 0x9311e8d7
popal
invalid
test dword [ebx + eax], ecx
in al, dx
xchg byte [eax], ah
pop es
dec ebx
and dword [ebx + 0x69], eax
xor dword [0x3148f93c], edx
dec esi
pop ss
insd dword es:[edi], dx
shr dword [edi + 0x11e579c2], 1
add eax, 0x534ec3b8
enter 0xffffffffffff9f3b, 0x57
xchg esi, eax
outsd dx, dword [esi]
pop eax
ret
Function at 0x49c168
Capabilities:
Encode data using xor

Disassembly:
jne 0x49c1d9
xor eax, ebx
or dl, ah
sub eax, dword [edi + 0xd]
jbe 0x49c206
xchg esi, eax
mov ebx, 0x35130bc0
jecxz 0x49c1f8
mov bl, 0xdb
shr esi, cl
inc edi
sbb eax, 0xaedc0eca
shl dword [edi + 0x4747bc60], cl
mov bh, 0xf9
pushal
mov esp, 0xf9b74747
mov dh, byte [ecx]
stc
xor al, 0x50
cmp al, 0x92
invalid
out dx, al
pop edi
cld
and ch, bh
dec esi
xor dword [edi + 0xe1bf9cf], 0xffffff85
xor bl, dh
popfd
jl 0x49c1ef
push cs
and esp, dword [ebp + 0x5cf0310d]
jae 0x49c244
cld
into
aad 0x36
out dx, eax
inc ebx
mov esi, 0xdc1248ce
jg 0x49c240
sbb eax, 0xfb58de47
xlatb
and al, 0xf9
fistp word [si + 0x47]
invalid
sar byte [ebp + 0x4a], 1
fimul word [esi - 0x24]
xchg ebx, eax
add ah, cl
jb 0x49c2ab
dec esi
fcom qword [ebx + 0x6072cc00]
dec eax
mov byte [0xb73c4a54], al
sbb byte [edx + 0x28], bl
mov byte [0x2dfc9c3a], al
mov edi, 0xaf8a26a
cdq
xor ebx, ebx
mov dl, 0xc7
xor al, 0x42
jl 0x49c244
sub byte [edi + 0x15ff1565], ah
cld
xor byte [eax], bh
add cl, byte [esi - 0x2cf35986]
ficomp dword [eax - 0x10]
xchg ecx, eax
daa
cmp byte [esi - 0x633da74], 0x71
nop
sub dword [ecx + 0x7b], esp
push es
xchg esi, eax
mov dh, ah
sub bl, ah
mov bl, 0x59
and eax, 0x6cbb7f7a
mov dword [eax], ecx
jnp 0x49c2a0
dec byte [edi + 0x52]
xchg esp, eax
adc eax, 0xf6c61e29
in eax, dx
ret
ret
Function at 0x4aea5e
Capabilities:
Encode data using xor

Disassembly:
sar esi, 0xae
loop 0x4ae97a
mov eax, dword [0xa3e2e8b1]
add eax, 0xf90cfa0d
mov dl, 0x6c
and al, byte [ecx - 0x3f4058d2]
and al, 0x77
mov dl, 0x8e
xchg edi, eax
test eax, 0x93362b11
mov edi, 0xb27724c0
mov ss, word [edi + 0x362b11a9]
xchg ebx, eax
dec ecx
popfd
adc byte gs:[eax - 0x519993e4], ah
pop ebp
lahf
fisub dword [edi + 0x1d]
add al, byte [ebx]
pop ss
xchg ebx, eax
jae 0x4ae96d
mov byte [0x60833911], al
cdq
shr byte [edx - 0x1f873fce], 3
lds esp, [eax + 0x1b]
adc ebp, dword [ebx - 0x28308e3c]
jne 0x4ae958
lahf
rol edx, 1
dec ecx
shr byte [edx + 0x3351a277], cl
shl byte [ebp + 0x31], cl
ja 0x4ae9ec
les esi, ds:[edx]
int1
popal
jnp 0x4ae9d3
and byte [ebx - 0x62deb235], al
push esp
std
cmp ah, ch
hlt
sbb esi, dword [edi + 0x41899bdd]
and esi, ebx
pop ss
dec ebp
sub al, 0x3f
sbb esi, dword [esi]
scasd eax, dword es:[edi]
popfd
xchg dword [eax - 0x5d], edi
aam 0xca
mov cl, 0xcf
xchg edi, eax
js 0x4ae98b
iretd
sahf
add dword [0x23cafdf5], 0x46
xor dl, byte [esp + edi]
daa
sal esp, 1
adc ecx, dword [ebx]
mov cl, 0x17
les ebx, [ebx + edx*2]
sub dword [esi + 0x6d23b288], 0x4351dcb2
jb 0x4ae9dc
push ecx
add eax, dword [edx]
and al, byte [esi + 0x1170f5a9]
cmc
wait
sti
dec edx
lahf
adc dword [ebx - 0x80], edx
test dl, al
wait
loopne 0x4aea6c
push esp
scasb al, byte es:[edi]
jge 0x4ae9e9
mov dl, 0x35
inc eax
lahf
invalid
hlt
add byte [ebx - 0x1d6c889d], 0xe6
jb 0x4ae9fc
adc dl, bl
jge 0x4aead4
push ss
nop
sub ah, byte [ecx]
mov bh, 0xdd
mov byte [0x8498a6ba], al
sub dl, dl
jae 0x4aea9b
cmpsb byte [esi], byte es:[edi]
cwde
test byte [edx], ch
sal byte [ebx + 0x20], cl
and bh, byte [ecx + 0x60080bf8]
loopne 0x4aeb00
or al, 0xd6
and eax, 0xdc7b1062
into
cmp esp, dword [eax - 0x67]
add ebx, dword [edx]
push edx
dec edx
and edx, dword [ebx + 0x2f]
inc eax
jbe 0x4aea92
cmp al, 0xdc
cmp al, 0xaa
stosd dword es:[edi], eax
mov dword [ebx - 0x605c6f85], esi
fdivr qword [ebx]
xor ah, 0x4c
loope 0x4aeabe
stosb byte es:[edi], al
jb 0x4aea74
add al, 6
mov byte [0x63a5e202], al
imul ecx, dword [0x82b30271], 0xcc8b35bc
loop 0x4aea5a
arpl word [ecx + 0xd], bp
jno 0x4aeabc
mov bl, 0x82
mov esp, 0x34cc8b35
xchg edi, eax
mov ecx, esp
xor al, 0x97
outsd dx, dword [esi]
insb byte es:[edi], dx
fisub dword [edi - 0x31]
mov ah, 0xff
add edi, dword [edx - 0x67]
cmp dh, bh
dec esp
inc edi
sbb eax, dword [ecx]
dec edi
jo 0x4aeab3
ficomp word [ebx - 0x5e]
rcr dword [edx], 1
or bl, 0xd8
pop ss
pop ebx
mov byte [0xcb801ad1], al
fsub dword [edi + 0x17]
int3
test byte [edi + 0xc], ch
imul ebx, ebp, 0xc8f14ab8
xchg ecx, eax
mov eax, 0x91c8f14a
xor esi, ebp
cdq
push esp
out dx, eax
cmp byte [edi + 0x41], 0xa9
call [edx - 0x2f]
cmp al, 0x15
and al, 0xd
xor eax, 0x460ebd83
and eax, 0xfc9e6547
scasd eax, dword es:[edi]
xchg edx, eax
inc edi
in al, dx
jle 0x4aeb05
lcall 0x6cb6, 0xc3f29c31
xchg ecx, eax
insb byte es:[edi], dx
inc esp
inc edx
sbb al, 0xf8
retf 0x4732
Function at 0x4b64db
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0x511e7e74
xor al, 9
daa
xchg esp, eax
mov gs, esi
cli
adc al, 0xe8
lcall 0x9593, 0x276d4816
insd dword es:[edi], dx
daa
xchg ebx, eax
xchg ebp, eax
fbld tbyte [ebx]
or esp, dword [edi + 0x31]
mov dl, 0xa
or al, 0x13
sar byte [eax + esi*4 - 0x76], cl
sub al, byte [esi - 0x5d]
in al, 0x1d
std
wait
sbb byte [eax + 0x4a780d7b], ah
daa
mov ah, 0xed
adc eax, 0xdbdf49b7
dec ecx
dec ebx
xor dword [edx], esp
push dword [edx - 0x6a9dd1fb]
mov al, byte [0x26721e5c]
mov eax, 0x1125013f
jle 0x4b64f0
shl byte [eax], cl
bnd js 0x4b64ec
je 0x4b6550
arpl word ss:[edi], sp
sahf
push ecx
and eax, 0xa714e24c
sti
leave
sbb byte [edx + ebp*8], dl
inc esi
aas
fidiv dword [edx]
jnp 0x4b64e9
invalid
insd dword es:[edi], dx
aas
invalid

Function at 0x4bb8c1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c4408
cmp edx, dword [eax]
je 0x4bb8e3
add eax, 8
inc ecx
cmp eax, 0x4c4498
jl 0x4bb8d4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c4408]
jne 0x4bba11
mov eax, dword [0x4c8d8c]
cmp eax, 1
je 0x4bb9eb
test eax, eax
jne 0x4bb914
cmp dword [0x4c4330], 1
je 0x4bb9eb
cmp edx, 0xfc
je 0x4bba11
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb94b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bc2a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc730
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb98e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc730
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0b64
push edi
call fcn.004be600
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bc2a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc2b0
lea eax, [ebp - 0xa0]
push 0x4c0b44
push eax
call fcn.004bc2b0
push dword [esi + 0x4c440c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc2b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be574
add esp, 0x2c
pop edi
jmp 0x4bba11
lea eax, [ebp + 8]
lea esi, [esi + 0x4c440c]
push 0
push eax
push dword [esi]
call fcn.004bc730
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x402e1d
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
push 1
push dword [esi]
call fcn.00404a28
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor eax, eax
push eax
push 0x25
cmp dword [ebp + 8], eax
jge 0x402e73
call edi
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
push eax
push 0x25
push 0x100
push dword [esi]
call ebx
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
jmp 0x402ea6
call edi
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
push eax
push 0x27
push 0x100
push dword [esi]
call ebx
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push dword [esi]
call ebx
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov esi, dword [esi]
push edi
push edi
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4

Function at 0x403303
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0xb0
push dword [edi]
call esi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jb 0x40332d
xor al, al
jmp 0x4033aa
push ebx
push 0
push 0
push 0xe
push dword [edi]
call esi
mov ebx, eax
test ebx, ebx
je 0x4033a7
cmp ebx, dword [ebp - 8]
jb 0x4033a7
cmp ebx, dword [ebp - 4]
jb 0x4033a7
xor ecx, ecx
push 2
pop edx
lea eax, [ebx + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00455667
pop ecx
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebx + 1]
push eax
push 0xd
push dword [edi]
call esi
test eax, eax
je 0x4033a3
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x403382
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + eax*2]
push eax
push dword [ebp + 8]
call fcn.0040204a
mov bl, 1
push dword [ebp - 0xc]
call fcn.0045526c
pop ecx
mov al, bl
jmp 0x4033a9
xor bl, bl
jmp 0x403396
xor al, al
pop ebx
pop esi
leave
ret 4
Function at 0x4046bc
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
mov esi, eax
mov eax, dword [ebp + 0xc]
push 0x46df88
call fcn.0040214f
mov edi, dword [ebp + 8]
push 1
push edi
call fcn.00404856
call dword [sym.imp.USER32.dll_GetFocus]
xor ebx, ebx
mov dword [esi + 0xd8], eax
cmp eax, ebx
je 0x40479f
push edi
push eax
call fcn.00404831
test eax, eax
je 0x40479f
push dword [esi + 0xd8]
call fcn.0040425c
push 0x100
lea eax, [ebp - 0x204]
push eax
push dword [esi + 0xd8]
mov dword [esi + 0xd4], edi
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [ebp - 0x204]
push eax
lea eax, [esi + 0x8c]
call fcn.0040214f
and dword [esi + 0x130], ebx
push esi
push 0x4047bf
push edi
call dword [sym.imp.USER32.dll_EnumChildWindows]
push dword [esi + 0x130]
lea eax, [ebp - 0x204]
push dword [esi + 0x8c]
push str._s_d
push eax
call fcn.0045732b
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp + 0xc]
call fcn.0040214f
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov al, 1
jmp 0x4047b8
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x404856
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 1
jne 0x404881
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x40489c
push 1
jmp 0x404883
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop ebp
ret 8