joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443ea5
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
test ecx, ecx
jne 0x443eb8
mov eax, 0x810002
jmp 0x4440b7
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x443ec8
push 2
pop eax
jmp 0x4440b6
push edi
lea edi, [ecx + 0x4b8]
xor eax, eax
movzx ecx, word [edi + 0x10]
and ecx, 0x3ff
sub edx, eax
je 0x443ef5
dec edx
je 0x443eea
push 5
pop eax
jmp 0x4440b5
mov dword [ebx], 0xf0027057
jmp 0x4440b5
movzx eax, byte [edi + 0x220]
push esi
movzx esi, byte [edi + 0x21e]
neg esi
sbb esi, esi
and esi, 0x4000
neg eax
sbb eax, eax
and eax, 0x40
or esi, eax
movzx eax, byte [edi + 0x258]
neg eax
sbb eax, eax
and eax, 0x8000
or esi, eax
movzx eax, byte [edi + 0x21f]
neg eax
sbb eax, eax
and eax, 0x20000
or esi, eax
movzx eax, byte [edi + 0x21c]
neg eax
sbb eax, eax
and eax, 4
or esi, eax
xor eax, eax
cmp byte [edi + 0x21d], al
setne al
or esi, eax
movzx eax, byte [edi + 0x21b]
neg eax
sbb eax, eax
and eax, 2
or esi, eax
movzx eax, byte [edi + 9]
neg eax
sbb eax, eax
and eax, 0x10
or esi, eax
dec ecx
je 0x444078
sub ecx, 6
je 0x444065
sub ecx, 3
je 0x44405c
dec ecx
dec ecx
je 0x444020
dec ecx
je 0x443fe4
sub ecx, 9
je 0x443fbb
sub ecx, 3
jne 0x4440b0
movzx eax, byte [edi + 2]
neg eax
sbb eax, eax
and eax, 0x40000000
or esi, eax
jmp 0x4440b0
mov eax, dword [edi + 0x230]
test eax, eax
jne 0x443fd0
or esi, 0x30000000
jmp 0x4440b0
cmp eax, 1
jne 0x444070
or esi, 0x10000000
jmp 0x4440b0
cmp byte [edi + 0x23d], 0
je 0x443ff6
cmp byte [edi + 0x23e], 0
jne 0x443fc5
movzx ecx, byte [edi + 0x23c]
movzx eax, byte [edi + 0x23e]
neg ecx
sbb ecx, ecx
and ecx, 0x20000000
neg eax
sbb eax, eax
and eax, 0x10000000
or ecx, eax
or esi, ecx
jmp 0x4440b0
mov ecx, edi
call fcn.004519ec
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x20000000
or esi, eax
mov eax, dword [edi + 0x22c]
test eax, eax
jne 0x444047
or esi, 0xc0000000
jmp 0x4440b0
cmp eax, 1
jne 0x444054
or esi, 0x40000000
jmp 0x4440b0
or esi, 0x80000000
jmp 0x4440b0
movzx ecx, byte [edi + 1]
movzx eax, byte [edi]
jmp 0x444004
mov eax, dword [edi + 0x228]
jmp 0x443fc1
or esi, 0x20000000
jmp 0x4440b0
movzx edx, byte [edi + 0x23a]
movzx eax, byte [edi + 0x239]
neg edx
movzx ecx, byte [edi + 0x238]
sbb edx, edx
and edx, 0x40000000
neg eax
sbb eax, eax
and eax, 0x20000000
or edx, eax
neg ecx
sbb ecx, ecx
and ecx, 0x10000000
or edx, ecx
or esi, edx
mov dword [ebx], esi
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x444dc9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 4
push eax
xor ebx, ebx
mov esi, edx
push 0x11
push ebx
push 0x412ae8
push SysReAllocString
mov edi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x444e45
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x412b5c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x444e45
cmp dword [ebp - 8], 4
jne 0x444e45
mov eax, dword [ebp - 0xc]
cmp eax, 3
ja 0x444e45
je 0x444e5e
cmp eax, 1
jne 0x444e3c
inc ebx
jmp 0x444e5e
cmp eax, 2
jne 0x444e45
push eax
pop ebx
jmp 0x444e5e
mov eax, esi
and eax, 0x10000000
je 0x444e56
test esi, 0x20000000
jne 0x444e5e
xor ebx, ebx
test eax, eax
sete bl
inc ebx
cmp dword [ebp - 4], 0
je 0x444e6d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi + 0x230], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44766a
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push edi
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 4], edx
mov edi, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x44768e
push 0x19
pop ecx
int 0x29
test byte [ebp - 0xc], 0x44
je 0x4476d6
push ebx
push esi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x40]
xor edx, edx
lea ecx, [ebx - 1]
mov eax, ecx
lea esi, [ebx - 1]
and ecx, dword [ebp - 4]
and eax, edi
add eax, ebx
dec ecx
add eax, ecx
not esi
div ebx
xor edx, edx
and esi, edi
mov ecx, eax
mov eax, dword [ebp - 4]
div ebx
add ecx, eax
je 0x4476d4
xor eax, eax
lock or dword [esi], eax
add esi, ebx
dec ecx
jne 0x4476ca
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x448c4a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
and dword [esi + 0x70], 0
test ebx, ebx
jne 0x448c65
xor al, al
jmp 0x448caa
push edi
push 0x412e18
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x448cb2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esi + 0x50], eax
test eax, eax
je 0x448cb2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 0x48], eax
test eax, eax
je 0x448cb2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, esi
mov dword [esi + 0x70], eax
call fcn.00448423
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
test edi, edi
jne 0x448cc5
xor al, al
jmp 0x448ca9
push 0x8007000e
lea ecx, [ebp - 0x2c]
call fcn.0044a2e3
push 0x495b40
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x4492d0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
push 0
push 0
push ebx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, eax
xor edx, edx
movzx eax, byte [esi + 0x20]
mov ecx, edi
mov dword [ebp - 4], eax
mov eax, edi
div dword [ebp - 4]
test edx, edx
je 0x44930a
mov ecx, dword [ebp - 4]
sub ecx, edx
add ecx, edi
mov dword [esi + 0x24], ecx
cmp edi, ecx
je 0x44931d
push 0
push 0
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, esi
call fcn.0044974d
push 0
mov edi, dword [eax]
and edi, 0xff000000
neg edi
sbb edi, edi
and dword [ebp - 8], 0
add edi, 2
shl edi, 2
sub edi, dword [esi + 0xc]
add edi, eax
lea eax, [ebp - 8]
push eax
push edi
push dword [esi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x449360
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4493ad
jmp 0x4493a5
cmp dword [ebp - 8], edi
je 0x449371
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4493ad
jmp 0x4493a5
cmp byte [esi + 0x16], 0
je 0x449389
mov eax, dword [esi + 4]
sub eax, dword [esi + 0x28]
push 0
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub eax, dword [esi + 0x24]
pop edi
mov dword [esi + 0x28], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x34]
call fcn.0044a2e3
push 0x495b40
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x449598
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
push 2
mov edi, ecx
push 0
push edi
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
test eax, eax
je 0x4495b7
xor eax, eax
jmp 0x449612
push esi
push edi
call dword [sym.imp.msvcrt.dll_ftell]
mov esi, eax
pop ecx
test esi, esi
je 0x4495f1
push 0
lea eax, [esi - 4]
push eax
push edi
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x4495f1
push edi
push 4
lea eax, [ebp - 4]
push 1
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, 4
je 0x4495f5
xor eax, eax
jmp 0x449611
mov eax, dword [ebp - 4]
test eax, 0xff000000
jne 0x449609
and eax, 0xffffff
add eax, 0xfffffff8
jmp 0x44960f
shr eax, 0x18
add eax, 0xfffffffc
add eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4497c0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [ecx + 0x19], 0
jne 0x4497eb
cmp byte [ecx + 0x16], 0
jne 0x4497eb
push 4
pop edx
cmp dword [ecx + 4], edx
jb 0x4497f1
mov eax, dword [ecx + 0xc]
mov dword [eax], edx
mov eax, dword [ecx + 0xc]
mov dword [ecx + 8], edx
mov dword [eax + 4], 0x4000000
pop ebp
jmp fcn.004492d0
pop ebp
ret 4
Function at 0x451881
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x48ac96
call fcn.004847b1
mov edi, ecx
mov dword [ebp - 0x10], edi
cmp dword [ebp + 8], 0
je 0x45192e
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x45192e
call fcn.00451149
push ebx
call fcn.00484ddf
mov esi, eax
mov dword [ebp - 0x18], esi
and dword [ebp - 4], 0
push ebx
push dword [ebp + 8]
push esi
call sub.msvcrt.dll_memcpy
add esp, 0x10
test ebx, ebx
je 0x4518fc
xor edi, edi
xor edx, edx
mov dword [ebp - 0x14], 3
push 0xc
mov eax, edi
pop ecx
div ecx
mov eax, edi
mov ecx, edx
xor edx, edx
div dword [ebp - 0x14]
mov al, byte [ecx + 0x412b78]
mov ecx, edx
shl al, cl
xor byte [edi + esi], al
inc edi
cmp edi, ebx
jb 0x4518ce
mov edi, dword [ebp - 0x10]
shr ebx, 1
add edi, 0x27c
push ebx
push esi
mov ecx, edi
call fcn.004670bb
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00451e82
mov ecx, dword [ebp - 0x10]
call fcn.00451595
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
call fcn.00484770
ret 8
push 0x80004005
lea ecx, [ebp - 0x44]
call fcn.0044a2e3
push 0x495b40
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x455f65
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48b3ce
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
mov eax, dword [0x49600c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x50], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov word [esp + 0x40], bx
jmp 0x455fed
mov ecx, dword [esp + 0x1c]
inc ebx
mov eax, dword [ecx + 4]
mov dword [esp + 0x34], eax
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
sete byte [esp + 0x40]
push ecx
lea eax, [esp + 0x10]
mov ecx, esi
push eax
lea edx, [esp + 0x24]
call fcn.0045602f
test al, al
jne 0x455fd7
cmp dword [esp + 0xc], 0
je 0x456014
push dword [esp + 0xc]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
mov eax, ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47a22d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, ecx
mov byte [ebp - 1], dl
push dword [ebx]
call fcn.0047a1e1
mov eax, dword [ebx]
movzx ecx, word [eax]
mov edi, ecx
cmp edi, 0x66
jg 0x47a330
je 0x47a326
push 0x30
pop edx
cmp edi, edx
jl 0x47a39f
push 0x37
pop esi
cmp edi, esi
jle 0x47a2e2
push 0x5c
pop esi
cmp edi, esi
je 0x47a2d3
cmp edi, 0x61
je 0x47a2c2
cmp edi, 0x63
je 0x47a28e
cmp edi, 0x65
jne 0x47a39f
push 0x1b
jmp 0x47a3a5
push dword [ebp + 8]
add eax, 2
push eax
mov dword [ebx], eax
call fcn.0047a1e1
mov eax, dword [ebx]
lea ecx, [eax + 2]
mov dword [ebx], ecx
movzx esi, word [eax]
lea eax, [esi - 0x61]
cmp ax, 0x19
ja 0x47a2ba
push esi
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
movzx esi, ax
xor esi, 0x40
jmp 0x47a3ab
cmp byte [ebp - 1], 0
je 0x47a39f
push 7
jmp 0x47a3a5
cmp byte [ebp - 1], 0
je 0x47a39f
jmp 0x47a3a6
lea ecx, [eax + 2]
mov dword [ebx], ecx
mov ax, word [eax]
sub ax, dx
push 0x37
movzx esi, ax
pop edi
mov ecx, dword [ebx]
movzx eax, word [ecx]
cmp dx, ax
ja 0x47a3ab
cmp di, ax
jb 0x47a3ab
push dword [ebp + 8]
lea eax, [eax + esi*8]
add eax, 0xffffffd0
movzx esi, ax
lea eax, [ecx + 2]
push eax
mov dword [ebx], eax
call fcn.0047a1e1
push 0x30
pop edx
jmp 0x47a2f3
cmp byte [ebp - 1], 0
je 0x47a39f
push 0xc
jmp 0x47a3a5
sub edi, 0x6e
je 0x47a399
sub edi, 4
je 0x47a38f
dec edi
dec edi
je 0x47a385
dec edi
dec edi
je 0x47a37b
dec edi
dec edi
jne 0x47a39f
add eax, 2
xor esi, esi
mov dword [ebx], eax
mov edi, dword [ebx]
movzx ecx, word [edi]
call fcn.0046e7b6
test al, al
je 0x47a3ab
movzx ecx, word [edi]
call fcn.0046e7eb
push dword [ebp + 8]
shl esi, 4
add eax, esi
movzx esi, ax
lea eax, [edi + 2]
push eax
mov dword [ebx], eax
call fcn.0047a1e1
jmp 0x47a34d
cmp byte [ebp - 1], 0
je 0x47a39f
push 0xb
jmp 0x47a3a5
cmp byte [ebp - 1], 0
je 0x47a39f
push 9
jmp 0x47a3a5
cmp byte [ebp - 1], 0
je 0x47a39f
push 0xd
jmp 0x47a3a5
cmp byte [ebp - 1], 0
jne 0x47a3a3
mov esi, ecx
jmp 0x47a3a6
push 0xa
pop esi
add eax, 2
mov dword [ebx], eax
pop edi
mov ax, si
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x483e10
Capabilities:
Terminate process

Disassembly:
call fcn.00484b68
jmp 0x483e1f
push 0x5c
push 0x4958b8
call fcn.004846b8
and dword [ebp - 0x24], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov edi, dword [eax + 4]
xor esi, esi
mov edx, 0x498894
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x483e6c
cmp eax, edi
jne 0x483e7e
mov esi, ebx
cmp dword [0x498898], ebx
jne 0x483e8b
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x483eba
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x483e55
cmp dword [0x498898], 0
jne 0x483eb4
mov dword [0x498898], ebx
push 0x401090
push 0x401084
call fcn.0048400a
pop ecx
pop ecx
test eax, eax
je 0x483eba
jmp 0x483ff3
mov dword [0x49806c], ebx
cmp dword [0x498898], ebx
jne 0x483edd
push 0x401080
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x498898], 2
test esi, esi
jne 0x483eea
xor eax, eax
mov ecx, 0x498894
xchg dword [ecx], eax
cmp dword [0x4988a4], 0
je 0x483f18
push 0x4988a4
call fcn.00484a60
pop ecx
test eax, eax
je 0x483f18
push 0
push 2
push 0
mov esi, dword [0x4988a4]
mov ecx, esi
call dword [0x49943c]
call esi
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov edi, dword [ebp - 0x24]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x483f76
test cl, cl
je 0x483f34
test edi, edi
jne 0x483f76
mov al, byte [esi]
test al, al
je 0x483f44
cmp al, 0x20
ja 0x483f44
inc esi
mov dword [ebp - 0x20], esi
jmp 0x483f34
test byte [ebp - 0x40], 1
je 0x483f50
movzx eax, word [ebp - 0x3c]
jmp 0x483f53
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x498068], eax
cmp dword [0x498080], 0
jne 0x483fcf
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cl, 0x22
jne 0x483f87
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x24], edi
movzx eax, cl
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x483f9a
inc esi
mov dword [ebp - 0x20], esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x483f25
cmp dword [0x49806c], 0
jne 0x483fe3
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x498068]
mov dword [ebp - 4], 0xfffffffe
jmp 0x483fff
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00484700
ret

Function at 0x48494f
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x4959b8
call fcn.00484618
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x4849af
cmp eax, 0xffffffff
je 0x4849af
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x4849a8
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x4849a8
cmp edx, 0x10000000
jae 0x4849a8
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x4849a5
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.0048465d
ret 4
Function at 0x484a10
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x484a4e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x484a46
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x484a50
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x484a36
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x484b30
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x484b46
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x484b61
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408e84
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5ec553bf
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3b8d57dc
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10060d5
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x102cd74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x218], eax
test eax, eax
je 0x100614d
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push edi
push 0
push 0
call esi
mov edi, eax
mov dword [ebp - 0x214], edi
test edi, edi
je 0x1006149
cmp edi, 0x3fff
jae 0x1006149
shl eax, 2
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x210], eax
test eax, eax
je 0x1006149
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
jne 0x100615c
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01026cc5
leave
ret 4
push ebx
push edi
call esi
xor edi, edi
cmp dword [ebp - 0x214], edi
jbe 0x10061a5
mov esi, dword [ebx + edi*4]
lea eax, [ebp - 0x20c]
push eax
push 0x1006
push 0
push esi
call sub.IMM32.dll_ImmEscapeW
test eax, eax
je 0x100619c
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x10061a7
inc edi
cmp edi, dword [ebp - 0x214]
jb 0x100616a
xor esi, esi
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
jmp 0x100614b
Function at 0x1006a81
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x102cd74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push esi
push edi
push 0
push eax
mov dword [ebp - 0x24], eax
call ebx
mov esi, eax
mov eax, dword [esi + 0x10]
imul eax, eax, 0x4c
push 0x1c
lea edi, [eax + esi + 0x1c]
lea eax, [ebp - 0x20]
push eax
push 1
push dword [esi + 4]
call sub.IMM32.dll_ImmGetCompositionStringW
test eax, eax
jge 0x1006ad3
mov dword [edi + 4], 3
jmp 0x1006bb0
cmp eax, 0x1a
jbe 0x1006adb
push 0x1a
pop eax
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x20], cx
mov dword [ebp - 0x28], eax
cmp dword [edi + 0x48], eax
jne 0x1006afe
lea eax, [ebp - 0x20]
push eax
lea eax, [edi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1006b6d
push 4
push dword [ebp - 0x24]
call ebx
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 0xe
lea eax, [edi + 0x2c]
push eax
call fcn.010063ee
test eax, eax
jl 0x1006bb0
test dword [ebp + 0xc], 0x800
push 0
pop eax
setne al
inc eax
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [edi + 0x48], eax
push dword [ebx + 0x18]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x1006b4d
push 1
push dword [ebx + 0x18]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [esi + 0x10]
sub eax, dword [ebx]
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
shl eax, 5
lea esi, [eax + ebx]
push 0
lea eax, [esi + 0x20]
push eax
push dword [ebp - 0x24]
call edi
push 0
jmp 0x1006ba7
test dword [ebp + 0xc], 0x800
je 0x1006bb0
push 4
push dword [ebp - 0x24]
call ebx
xor ebx, ebx
cmp dword [edi + 4], ebx
je 0x1006b8b
mov dword [edi + 4], 2
mov ecx, dword [esi + 0x10]
sub ecx, dword [eax]
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
shl ecx, 5
lea esi, [ecx + eax]
push ebx
lea eax, [esi + 0x20]
push eax
push dword [ebp - 0x24]
call edi
push ebx
add esi, 0x30
push esi
push dword [ebp - 0x24]
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01026cc5
leave
ret 8
Function at 0x1009585
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x660
mov eax, dword [0x102cd74]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
push 0xef42
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x660], ecx
call fcn.010245ad
mov esi, 0x104
push esi
push 0xef5d
lea eax, [ebp - 0x65c]
push eax
call fcn.010245ad
push esi
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0101e94a
test eax, eax
jne 0x1009620
push esi
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push 0x1001d88
push esi
lea eax, [ebp - 0x24c]
push eax
call fcn.010082c0
test eax, eax
jge 0x1009608
xor eax, eax
jmp 0x1009718
lea eax, [ebp - 0x65c]
push eax
push esi
lea eax, [ebp - 0x24c]
push eax
call fcn.010082c0
test eax, eax
jl 0x1009601
lea eax, [ebp - 0x24c]
push eax
push esi
lea eax, [ebp - 0x454]
push eax
call fcn.01008286
test eax, eax
jl 0x1009601
lea eax, [ebp - 0x454]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x1009652
xor ecx, ecx
mov word [eax], cx
push 0x1001d7c
push esi
lea eax, [ebp - 0x454]
push eax
call fcn.010082c0
test eax, eax
jl 0x1009601
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, eax
call edi
sub eax, ebx
cmp eax, 0x3e8
jb 0x1009674
push 0
call sub.GDI32.dll_EnableEUDC
lea eax, [ebp - 0x24c]
push eax
call fcn.0100b14b
xor edi, edi
inc edi
test eax, eax
je 0x10096c8
lea eax, [ebp - 0x454]
push eax
call fcn.0102533d
cmp eax, edi
jne 0x10096c8
mov ecx, dword [ebp - 0x660]
push 0xffffffffffffffff
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.0100931b
test eax, eax
je 0x100970e
lea eax, [ebp - 0x44]
push eax
push 0x20
push 0x102ce50
mov dword [0x102d2ac], edi
call fcn.01008286
test eax, eax
jl 0x100970e
lea eax, [ebp - 0x24c]
push eax
push esi
push 0x102ce90
call fcn.01008286
test eax, eax
jl 0x100970e
lea eax, [ebp - 0x65c]
push eax
push esi
push 0x102d098
call fcn.01008286
test eax, eax
jge 0x1009725
push edi
call sub.GDI32.dll_EnableEUDC
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01026cc5
leave
ret
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0101ead5
test eax, eax
jne 0x1009745
xor esi, esi
push edi
call sub.GDI32.dll_EnableEUDC
mov eax, esi
jmp 0x1009716
mov esi, edi
jmp 0x100973b