joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d300
Capabilities:
Encode data using xor

Disassembly:
push esi
daa
in eax, 0xbd
imul ecx, esp, 0x56
or dword [ecx + ecx*4 + 4], esp
fisubr word [edi + 0x69]
outsb dx, byte [esi]
scasb al, byte es:[edi]
push ecx
outsd dx, dword [esi]
pop edx
sub byte [eax], al
cdq
push 0x11
lodsb al, byte [esi]
dec edi
cmp esp, 0xead5326f
push esp
pop ecx
or eax, 0xd2a39abe
xor bl, byte [ecx + ecx*8 + 0x67940449]
sbb esi, dword [eax - 0x1b]
adc ecx, 0x5cfacdd5
lahf
lea ecx, [edx - 0x146fd86f]
jl 0x40d2c6
jns 0x40d334
sub dh, ch
cmc
lodsb al, byte [esi]
adc al, 0x9a
and eax, 0x8fa694d1
dec esp
xchg ecx, eax
aas
pop ds
imul edx, dword [esp + ebx*2 + 0x7e0f0823], 6
add edi, dword [ebx + edx + 0x7dc9502d]
aaa
mov edi, 0xa0c76035
loop 0x40d309
stc
fxch st(3)
test ah, 0xb3
hlt
mov bl, 0xf4
inc edx
aam 0xa9
inc ebp
xor al, 0xe5
sbb dl, al
pop esp
out dx, al
dec ebp
add byte [eax - 0x492a2ad5], cl
and dword [ebx + 0x59], eax
nop
mov ecx, 0x98f3ed8d
push edx
pop edi
mov bh, 0x77
inc ecx
neg dword [eax - 0x3d6ae8c2]
jge 0x40d3ba
outsb dx, byte [esi]
ficom word [edx + 0x5b]
and al, byte [ebx - 0x33]
sbb byte [ebx], bh
jge 0x40d399
retf
xchg esi, eax
xchg edx, eax
inc edi
inc eax
xor eax, 0xeee03383
sub eax, 0x1dacd7aa
cli
xor cl, byte [edi - 0x7d8d79bb]
mov dh, 0xdb
fscale
mov edx, 0xd82150c0
add ah, al
xlatb
sbb edx, esi
xchg esp, eax
invalid

Function at 0x429040
Capabilities:
Encode data using xor

Disassembly:
div dword [esi]
or al, 0x1d
cwde
push cs
push es
sal byte [eax - 0x62], 0xe7
mov dword [0xd7b1429b], eax
mov dword [0xbafe99b0], eax
salc
in eax, 0xc6
pushfd
mov esi, 0xe3a55e25
adc byte [edi], al
lodsd eax, dword [esi]
jo 0x429071
inc edi
daa
cmp al, 0x33
invalid
retf 0xb5bb
and eax, 0xecc18b24
fcomi st(5)
pop esi
sub dword [edi + eax*8], 0x49
jo 0x429034
or ebp, dword [eax + 0x7a]
add dword [esi + esi*2 - 0x16], ebx
sub dword [edi], esp
mov dword [0x2b696e08], eax
adc al, 0x8d
in eax, dx
clc
jl 0x42909c
out 0xa, eax
je 0x42900c
mul byte [eax + 0x55]
cmp dl, byte [edi - 1]
adc ebx, dword [edx + 0x76]
adc edx, edx
sbb al, 0x3e
rcr byte [esi + edi], cl
push ss
pushal
invalid
mov esp, 0x4c791cee
sbb eax, 0x9547e454
xor bl, byte [edx]
fcomp qword [ecx - 0x52]
jl 0x4290ab
movsb byte es:[edi], byte [esi]
cmpsd dword cs:[esi], dword es:[edi]
invalid
Function at 0x5f2c62
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.005f2e12
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x5f2d60
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x5f2d03
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x5f2d46
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x5f2d1a
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x5f2d35
test al, 0x40
je 0x5f2d2c
mov ecx, dword [edi + 0x20]
jmp 0x5f2d33
test al, 0x80
je 0x5f2d46
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x5f2d46
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x5f2cd2
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x794391
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.00794cc0
movsd dword es:[edi], dword [esi]
jmp 0x7c106f
xchg di, ax
sub esp, 0xa
lea edi, [esp + edx]
jmp 0x7941a1
cmp eax, 1
push esp
jmp 0x766315
mov byte [esp + 1], ah
jmp 0x7943cd
movzx ebx, byte [esi + 0x11]
jmp 0x79442a
lea esp, [esp + 4]
push ecx
call 0x76638a
movsd dword es:[edi], dword [esi]
mov word [esp], di
mov byte [esp], dh
push esp
jmp 0x766415
mov dword [esp + 1], ecx
pop dword [esp]
jmp 0x76637f
push edi
mov esi, ecx
pushal
mov byte [esp + 9], bh
push word [esp + 0x15]
jmp 0x766431
push esi
lea esi, [ecx + edi]
lea esi, [esi + edi]
not si
lea esi, [ebx + edi]
jmp 0x7663d1
lea esp, [esp + 8]
push ecx
push ebx
jmp 0x7663ea
mov byte [esp + 1], bh
lea esp, [esp + 2]
lea esp, [esp + 0x20]
call fcn.0077e18c
setne bl
jmp 0x794462
pop dword [esp]
lea esp, [esp + 2]
mov eax, dword [edx - 8]
call fcn.00794174
add eax, dword [edx + ebx - reloc.WINMM.dll_midiStreamOut]
xor dword [ecx - reloc.WINMM.dll_midiStreamOut], esp
mov bl, 0xaa
lea esp, [esp + 0xc]
lea ecx, [esi + 8]
jmp 0x7662f2
mov dword [esp + 0x10], eax
pushal
pop dword [esp + 0xe]
lea esp, [esp + 0x1c]
popal
call fcn.00794235
ror dword [edx + eax*8 - 0x5b], cl
push esp
jecxz 0x7943b4
invalid
lea ebx, [eax - 0xf1]
stc
rcr bh, 3
pushal
neg cx
jmp 0x794353
cmp dword [ebp - 4], ebx
call 0x794391
push esi
lea esp, [esp + 3]
lea esp, [esp + 1]
jl 0x7662f2
jge 0x7943c2
fiadd word [ecx - 0x2f]
mov al, 0x43
test byte [eax + 0x2f79002], ah
test dword [ebx - 6], eax
aad 0x44
test dword [ebp - reloc.WINMM.dll_midiStreamOut], 0x831c2464
rcl dword [eax], 0x83
ljmp 0x2404
and al, 2
lea esp, [esp + 0x1c]
add ecx, 0x10
sub edx, 0x10
jmp 0x794388
mov eax, dword [esp]
mov eax, dword [ebp - 8]
jmp 0x76630b
lea esp, [esp + 4]
jle 0x7662da
shr dh, 7
bsr di, cx
jmp 0x794418
mov bl, byte [esp]
mov dword [ebp - 4], ecx
add edx, ebp
xchg bh, cl
mov dl, dh
jmp 0x794443
or ebx, eax
lea edi, [esi - 0xa5]
lea ecx, [eax - 1]
bts ebx, esp
bswap ebx
jmp 0x7943fa
lea edi, [edx*4]
bsr di, cx
not edi
lea edi, [ebx + edi]
jmp 0x7944f3
sub esp, 8
lea esp, [esp + 8]
mov ecx, 0xff
jmp 0x766369
bswap ebx
lea ebx, [esp + ebp]
sub esp, 4
lea esp, [esp + 4]
and dword [ebp - 4], 0
jmp 0x794378
lea edi, [eax + edi]
pushal
cpuid
mov dword [esp + 0x28], esi
call fcn.007944b5
aas
mov edi, 0x2b94a2f
pop ss
nop
push es
popal
nop
and ecx, dword [ebp + reloc.WINMM.dll_midiStreamOut]
add esi, 0x10
push ebp
pushal
jmp 0x794477
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov di, sp
not dh
mov dh, byte [esp]
ror di, cl
jmp 0x794497
pushal
pop word [esp + 7]
pop word [esp + 0xf]
push dword [esp + 0x1a]
mov dword [esp + 0x1c], 0xa279a5a7
call int.007c10ad
mov ebp, eax
invalid
retf

Function at 0x7947aa
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 1
lea esp, [esp + 3]
jmp 0x7947d2
Function at 0x794970
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
cmc
call fcn.00794acc
pushal
in eax, 0x75
sbb al, 0xef
pop esi
xchg edx, eax
push ss
test bl, ah
push ds
scasd eax, dword es:[edi]
pop es
scasb al, byte es:[edi]
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x794943
add esp, 1
lea esp, [esp + 3]
jmp 0x794959

Function at 0x794a95
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
popal
push esp
mov dword [esp], esi
jmp 0x794aa4
mov ax, 0x7941
xchg ah, bl
xchg cx, bx
mov dword [esp + 4], edx
jmp 0x794a79
shr edi, 0x18
sub esp, 0xa
add esp, 1
add esp, 2
lea esp, [esp + 3]
jmp 0x794adc
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
call fcn.00794ab6
push eax
retf 0x3f58

Function at 0x794acc
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
push esp
mov dword [esp], eax
mov byte [esp + 2], bh
jmp 0x7949bd
push word [esp + 9]
mov word [esp + 2], dx
cmc
jmp 0x794979
lea esp, [esp + 3]
mov byte [esp], dh
lea esp, [esp + 1]
and edx, ecx
sub esp, 0x12
jmp 0x794991
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x794a6d
mov dword [reloc.WINMM.dll_midiStreamOut], eax
loop 0x794a3d
pop ss
loop 0x7949f6
mov dword [reloc.WINMM.dll_midiStreamOut], eax
popfd
enter 0x770d, 0
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
neg ebx
movzx ebx, byte [esi + 0xd]
push esp
jmp 0x7949ab
push ebp
mov ebp, ebx
lea ebp, [ebp*4]
jmp 0x7949f3
lea ebp, reloc.WINMM.dll_midiStreamOut
mov ebx, dword [ebp]
pop ebp
sbb di, 0xa1b6
jmp 0x794a54
add eax, 0x5d8b0077
add byte [ebp + 0x66], bl
add byte [ebx + 0x665d005d], cl
sbb edi, 0x50eba1b6
and eax, 0xaa5f38aa
sbb eax, 0xc568b4b
mov edx, dword [esi + 0xc]
cmc
mov dword [esi + 8], edi
neg edi
jmp 0x7949e3
fucompi st(3)
int 0xec
pushal
not byte [ecx - 0x62ed2da0]
or eax, 0x6c64a754
jg 0x794a6b
lea esp, [esp + 0x2c]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
mov dx, 0x14f1
lea edx, [edx + ebp]
lea edx, [esp + esi]
jmp 0x794a0b
pushal
call fcn.00794a95
loope 0x794ab5
loope 0x7949c6
jae 0x7949f8
loope 0x794abc
loopne 0x7949d3
jb 0x794a13
ljmp 0xbf66:0xcea7b405
mov di, 0x40d7
jmp 0x794a3c
xchg edi, eax
and edx, ecx
and edx, ecx
sub esp, 0x16
push edx
lea esp, [esp + 2]
jmp 0x794a25
sub esp, 0x14
sub esp, 0x1c
jmp 0x794d81
mov word [esp], dx
add esp, 1
lea esp, [esp + 3]
jmp 0x7949d3
and edi, ecx
sub esp, 0xc
mov dword [esp + 7], esi
call fcn.00794b3a
cmp al, 0x2f
jne 0x794e6a
call fcn.00795a1c
popal
fstp dword [edx + esi*8 - 0x6b]
xlatb
sub dword [eax - 0x15], ecx
add dh, byte [ecx - 0x1f69dc30]
and ebp, eax
call fcn.00795a0d
pop esi
ret 0x3750
ret 0x1c74
call fcn.00795a21
xor al, 0xb9
sub dword [eax - 0x45], ecx
push cs
push ss
lcall 0x527b, 0x289a6f08
int 0x5c
scasd eax, dword es:[edi]
movzx esi, bl
cmp bl, 0x39
push edx
jmp 0x795c0e
jmp 0x795c77
lea esp, [esp + 0xc]
ja 0x794ed7
push esp
add esp, 3
jmp 0x795c2b
push word [esp + 1]
push dword [esp + 2]
push dword [esp]
lea esp, [esp + 2]
jmp 0x795bf8
sub esp, 0xe
pop dword [esp + 6]
lea esp, [esp + 3]
lea esp, [esp + 8]
add esi, 4
jmp 0x794eee
pushal
pop dword [esp + 0x14]
lea esp, [esp + 0x1c]
cmp bl, 0x5a
call fcn.00795c60
Function at 0x794c6a
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
call fcn.00794c82
or ecx, dword [edx + eax - reloc.WINMM.dll_midiStreamOut]
sbb dword [ecx - 0x757e418], ecx
fucomi st(3)
jmp 0x794c53
lea esp, [esp + 1]
jmp 0x794c87
jmp 0x794c53
lea esp, [esp + 0xc]
jne 0x766369
je 0x7662da
leave
inc edx
sal byte [edi + 0x3a83f642], 1
adc eax, 0xe91e3784
invalid
sar esi, 1
invalid

Function at 0x794c6c
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
call fcn.00794c82
or ecx, dword [edx + eax - reloc.WINMM.dll_midiStreamOut]
sbb dword [ecx - 0x757e418], ecx
fucomi st(3)
jmp 0x794c53
lea esp, [esp + 1]
jmp 0x794c87
jmp 0x794c53
lea esp, [esp + 0xc]
jne 0x766369
je 0x7662da
leave
inc edx
sal byte [edi + 0x3a83f642], 1
adc eax, 0xe91e3784
invalid
sar esi, 1
invalid

Function at 0x794ca3
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
jmp 0x794c3f
and edx, ecx
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
pushal
lea esp, [esp + 0x1f]
jmp 0x794b44
mov dword [esp], eax
push word [esp + 1]
lea esp, [esp + 2]
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
cmc
jmp 0x794b5b
and edx, ecx
call 0x794b97
outsd dx, dword [esi]
mov word [esp], di
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x794c17
lea esp, [esp + 3]
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
stc
cmc
jmp 0x794b8f
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
pushal
lea esp, [esp + 0x17]
call fcn.00794bf1
and ebx, ecx
pushal
sub esp, 0xc
lea esp, [esp + 0x23]
push word [esp + 4]
jmp 0x794bb9
jmp 0x794b79

Function at 0x8986da
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.00897018
pop word [esp + 3]
mov dword [esp], eax
lea esp, [esp + 2]
jmp 0x8988b7
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x897013
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x898765
mov dword [esp + 0x6c], edi
lea esp, [esp + 0x6c]
jmp 0x898815
Function at 0x5508b4
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x5508ec
jmp 0x5508d0
lea esp, [esp + 4]
jmp 0x550897
jmp 0x550908
jmp 0x550924
push ebx
jmp 0x550940
jmp 0x55095c
push ebp
jmp 0x550978
jmp 0x550994
push esi
jmp 0x5509b0
jmp 0x58330d
push edi
movzx edx, byte [eax]
jmp 0x583363
shl edx, 8
jmp 0x5833f1
shl edx, 8
xor edx, esi
jmp 0x5835bd
movzx esi, byte [eax + 1]
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
jmp 0x5833d1
movzx esi, byte [eax + 5]
mov dword [ecx], edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 9]
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xb]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xd]
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
mov esi, 0xff
and eax, esi
mov eax, dword [eax*4 + 0x55a234]
xor eax, 0x1000000
mov edi, edx
shr edi, 8
and edi, esi
mov edi, dword [edi*4 + 0x55a234]
and edi, 0xff0000
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0x55a234]
xor eax, edi
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + 0x55a234]
mov ebp, 0xff00
and edi, ebp
xor eax, edi
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
mov dword [ecx + 0x1c], edx
call fcn.005701bc
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + 0x55a234]
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0x55a234]
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
mov edi, edx
and edx, esi
mov edx, dword [edx*4 + 0x55a234]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x55a234]
xor ecx, edi
and edx, ebp
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
cmp ebx, 0x55ba5c
jne 0x5836a0
push 0xa
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x551bb7
Capabilities:
Encode data using base64

Disassembly:
jmp 0x551bd3
lea esp, [esp + 4]
jmp 0x551d93
jmp 0x551c0b
jmp 0x551c27
push ebp
jmp 0x551c43
jmp 0x551c5f
mov ebp, esp
jmp 0x551c7b
jmp 0x551c97
movzx eax, byte [ecx]
jmp 0x551cb3
jmp 0x551ccf
shl eax, 0x10
jmp 0x551ceb
jmp 0x551d07
cmp dword [ebp + 0xc], 2
jmp 0x551d3f
jmp 0x58436b
jmp 0x551d5b
jb 0x551d23
jae 0x551d77
push ecx
add dword [0x1c75e574], edx
out dx, eax
sbb bl, cl
pop ecx
leave
test al, 0x5b
invalid
jmp 0x584330
jmp 0x551bef
movzx edx, byte [ecx + 1]
jmp 0x58439f
cmp dword [ebp + 0xc], 3
jne 0x5843ab
movzx ecx, byte [ecx + 2]
or eax, ecx
jmp 0x5843ab
push 0x3f
mov esi, eax
shr ecx, 0x12
pop edx
jmp 0x584492
shl edx, 8
or eax, edx
jmp 0x551d23
push ebx
push esi
push edi
mov ecx, eax
jmp 0x58437c
cmp dword [ebp + 0xc], 3
jne 0x584448
je 0x58442b
xchg edx, eax
setg dl
or dword [ecx + 0x6001910b], esp
xchg ebx, eax
cmp ah, ah
adc dword [ebx], 0x76
test dword [edi + edi*8], edi
not dword [bp + si - 0x399f]
wait
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
call 0x7fe52997
retf 0x2254
mov edi, dword [ebp + 0xc]
jmp 0x5843e0
and eax, edx
jmp 0x584466
mov ebx, dword [ebp + 0xc]
jmp 0x5844ad
mov ebx, eax
jmp 0x5844ad
shr esi, 0xc
and ecx, edx
and esi, edx
cmp dword [ebp + 0xc], 2
jb 0x584425
mov edi, eax
shr edi, 6
and edi, edx
jmp 0x5843e0
push 0x3e
pop eax
cmp ecx, 0x1a
jmp 0x5846e8
cmp ecx, eax
jmp 0x584590
xor edx, edx
cmp ecx, eax
setne dl
lea edx, [edx*4 + 0x2b]
jmp 0x5845df
cmp esi, 0x34
jae 0x584611
jb 0x5845f0
mov bl, byte [edi]
invalid
jae 0x584528
lea edx, [ecx - 4]
jmp 0x5845df
cmp dword [ebp + 0xc], 2
jmp 0x584827
mov ecx, dword [ebp + 8]
mov byte [ecx], dl
cmp esi, 0x1a
jae 0x584571
lea ecx, [esi + 0x41]
jmp 0x5845a2
lea ecx, [esi + 0x47]
jmp 0x5845a2
cmp esi, eax
jae 0x584651
jb 0x584698
cmp ebp, dword [ebx + 0x2ad5e3b]
push esi
iretd
xor ecx, ecx
cmp esi, eax
setne cl
jmp 0x5846a7
lea ecx, [esi - 4]
jmp 0x5845a2
lea ecx, [ecx*4 + 0x2b]
jmp 0x5845a2
jae 0x58486d
lea edx, [ecx + 0x41]
jmp 0x5845df
mov byte [edx + 2], cl
jmp 0x5847fb
cmp edi, 0x34
jae 0x58473c
lea ecx, [edi + 0x47]
jmp 0x5846f9
cmp edi, eax
jae 0x5847df
lea ecx, [edi - 4]
jmp 0x5846f9
mov byte [edx + 2], 0x3d
jmp 0x5847fb
mov byte [edx + 3], 0x3d
jmp 0x5848b1
xor ecx, ecx
cmp edi, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x5846f9
cmp dword [ebp + 0xc], 3
jne 0x584793
cmp ebx, 0x1a
jae 0x584c9c
lea ecx, [ebx + 0x41]
jmp 0x584b9b
mov edx, dword [ebp + 8]
mov byte [edx + 1], cl
jb 0x58478b
cmp edi, 0x1a
jae 0x584719
lea ecx, [edi + 0x41]
jmp 0x5846f9
cmp ecx, 0x34
jae 0x5844e2
lea edx, [ecx + 0x47]
jmp 0x5845df
pop edi
pop esi
pop ebx
pop ebp
ret
xor ecx, ecx
cmp ebx, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x584b9b
cmp ebx, eax
jae 0x5849b7
lea ecx, [ebx - 4]
jmp 0x584b9b
mov byte [edx + 3], cl
jmp 0x5848b1
cmp ebx, 0x34
jae 0x5849e3
lea ecx, [ebx + 0x47]
jmp 0x584b9b
Function at 0x5529f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x585975
lea esp, [esp + 4]
jmp fcn.00585957
Function at 0x5725f0
Capabilities:
Encode data using base64

Disassembly:
call 0x5519d9
jmp 0x551bb2

Function at 0x572d45
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x552974
jmp 0x5529f3

Function at 0x57ddc7
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
jmp 0x57de10
cmp word [ecx], ax
je 0x57de32
xor eax, eax
jmp 0x57ded3
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x57de15
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
pop ebp
ret
pop ebp
ret

Function at 0x5e13cb
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
adc dword [edx + edx*2], 0xffffffab
int3
je 0x5df1ba
lea esp, [esp + 8]
popal
jmp 0x5df0ef
call 0x5575ee
jmp 0x5e137d
call 0x5df196
pop eax
sub eax, 0x5df196
cmp dword [eax + 0x54a051], 0
jmp 0x5df165
inc dword [eax + 0x54a051]
push 0xae09a953
add dword [esp], 0x524a29aa
push 0
push 0
push 0xb7c37d46
add dword [esp], 0x4890467b
jmp 0x5df173
push eax
jmp 0x5df191
call 0x5e1382
jmp 0x5e13d9
call 0x5e13cb
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x63694c20
outsb dx, byte gs:[esi]
jae 0x5e142a
jb 0x5e13dd
inc esp
insd dword es:[edi], dx
outsd dx, dword [esi]
and byte [esi + 0x31], dh
cmp byte cs:[esi], ch
xor byte [esi], ch
xor byte [eax], al
jmp 0x5e14fb
add dword [esp], 0x126e
call 0x5553a4
call 0x5569bf
adc al, byte [eax]
add al, ch
mov edi, 0xe8fff73f
aad 0x55
idiv edi
popal
jmp 0x5df0ef
call 0x5e13f8
jmp 0x5e14a4
mov byte [ecx - 0x35], ah
inc esi
aam 0xb3
dec esi
mov edx, 0x5f38aa38
stosb byte es:[edi], al
inc edx
and dword [edx + 0x47b24720], esi
mov eax, 0x28d9be28
invalid
movzx ebx, word [eax + 0x3c]
add ebx, eax
cmp word [ebx], 0x4550
je 0x5df1f1
jmp 0x5e14af
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0x5e144d
sub eax, 0x10000
jmp 0x5e14a8
lea esp, [esp + 4]
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x5e13f3
Function at 0x409af0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
push eax
push dword [esp + 0xc]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x409b0c
mov dword [esp], 1
jmp 0x409b1c
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x409c2e
mov ebx, dword [esp + 0x10]
cmp ebx, 1
je 0x409b4e
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x409b3e
mov dword [esp], 1
jmp 0x409b4e
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x409c2e
mov ebx, dword [esp + 0x14]
cmp ebx, 1
je 0x409b80
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x409b70
mov dword [esp], 1
jmp 0x409b80
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x409c2e
mov ebx, dword [esp + 0x18]
cmp ebx, 1
je 0x409baf
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x409ba2
mov dword [esp], 1
jmp 0x409baf
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x409c2e
mov ebx, dword [esp + 0x10]
cmp ebx, 1
jne 0x409bd5
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x409bd5
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x409c2e
mov ebx, dword [esp + 0x14]
cmp ebx, 1
jne 0x409bfb
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x409bfb
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x409c2e
mov ebx, dword [esp + 0x18]
cmp ebx, 1
jne 0x409c21
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x409c21
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x409c2e
xor edx, edx
mov eax, 1
jmp 0x409c2e
add esp, 4
pop ebx
ret 0x10

Function at 0x40c98c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x40ca70
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test byte [ebp + 0x10], 1
mov ebx, eax
je 0x40ca26
push edi
push edi
push edi
push dword [ebp + 0xc]
call fcn.0040d4d5
mov ebx, eax
cmp ebx, edi
je 0x40ca65
push dword [ebp + 8]
push dword [0x4a914c]
call fcn.00413ab3
mov esi, eax
mov eax, 0x10000
push eax
push ebx
mov dword [esi + 0x18], eax
call fcn.0040d478
push eax
push ebx
call fcn.0040d45e
push eax
call fcn.0040d0b9
cmp eax, edi
mov dword [esi], eax
je 0x40ca1e
mov dword [esi + 0x14], ebx
mov dword [ebp - 4], esi
jmp 0x40ca65
push ebx
call fcn.0040d485
jmp 0x40ca65
push ebx
push edi
push dword [0x4a89d4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
je 0x40ca65
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push esi
push dword [ebp + 8]
call fcn.0040d0a3
push esi
push edi
push dword [0x4a89d4]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
leave
ret 0xc