joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420cd4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x420cda
ret

Function at 0x42ce70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42d021
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404e50
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x42d038
call fcn.00404aac
mov eax, ebx
call fcn.0041eba4
mov edi, eax
dec edi
test edi, edi
jl 0x42cf28
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041eb78
mov edx, dword [0x435edc]
call fcn.00403bbc
test al, al
je 0x42cf24
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041eb78
lea edx, [ebp - 0x14]
call fcn.0043fabc
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404e50
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b20
inc esi
dec edi
jne 0x42ced6
mov al, byte [0x42d03c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x42d048
mov eax, dword [ebp - 0xc]
call fcn.0040da38
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404838
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0043fabc
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x42d038
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0043fabc
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x42d038
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x42d038
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x42d054
call fcn.00409c18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d028
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004047c4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004047c4
lea eax, [ebp - 0x14]
call fcn.004047a0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004047c4
ret

Function at 0x461570
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004076c0
ret
Function at 0x4744a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x4744b5
add esp, 0xfffffff0
call fcn.00403d54
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404c50
xor eax, eax
push ebp
push 0x47457c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004700a0
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.00417514
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x24], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.00417514
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x3c], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.00417514
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x34], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.00417514
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x2c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.0041753c
push esi
lea edi, [esi + 0x40]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
mov byte [esi + 0x50], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474583
lea eax, [ebp - 4]
call fcn.004047a0
ret
Function at 0x4792d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4793d4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x4793ec
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 4]
lea eax, [ebx + 8]
call fcn.004047f4
push 0xffffffffffffffff
mov ecx, 0x4793fc
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x30], eax
mov ecx, 0x479418
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00482a34
mov byte [ebx + 0xc], al
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x479434
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00482920
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0xd]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x479448
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00482920
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x1d]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x479460
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00482920
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov ecx, 0x47947c
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00482a34
mov byte [ebx + 0x44], al
mov ecx, 0x479490
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0046fd7c
mov byte [ebx + 0x45], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4793db
lea eax, [ebp - 4]
call fcn.004047a0
ret

Function at 0x49d644
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x49d69e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x2c8], ecx
mov dword [esi + 0x2cc], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x2bc], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c8]
mov eax, esi
call fcn.0049d6a8
mov eax, dword [esi + 0x2c8]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d6a5
ret
Function at 0x9c2774
Capabilities:
Encode data using xor

Disassembly:
add edi, eax
pushfd
pushal
clc
mov edi, dword [edi + ecx*4]
test esi, 0x183d1134
test edi, edi
call fcn.009baf25
fmul dword [ecx + 0x1821f842]
mov bh, 0x46
lodsd eax, dword [esi]
inc eax
imul edx, ebp, 0xffffffb3
mov edi, dword fs:[eax - 0x57f085a9]
xor bl, byte [ecx + 0x18]
push esp
mov dword [ecx + 0x17], edi
mov al, 0x2a
arpl word [ebx - 0x40], di
xor word [ecx], si
salc
xor esi, dword [esi]
aam 0xfc
wait
or ch, byte [0xc94d5008]
push edx
add byte [0x926dbb14], ah
xchg dword [eax], esi
or ebp, dword [edi + 0xa]
lodsb al, byte [esi]
cmp ebp, edx
pop esp
adc al, 0xcf
xor dword [edx], 0x602b75e0
invalid
Function at 0x47dad6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x575f70
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x5be904], 1
jge 0x575fdf
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x575fb5
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x575fb5
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x575f92
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x575fcb
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x575fd2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x5760cf
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x5760a0
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x576095
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x576089
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x576090
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x5760cf
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x5760ca
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x5760b3
mov eax, dword [ebx + 8]
jmp 0x5760cf
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x5760c1
xor eax, eax
jmp 0x5760cf
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x575fff
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x480eb1
Capabilities:
Query environment variable

Disassembly:
jmp 0x561121
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x561135
xor edi, edi
jmp 0x561179
push ebx
push esi
call fcn.00561018
sub eax, esi
sar eax, 1
push 0x40
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
lea ebx, [eax + eax]
push ebx
call fcn.0047ec1f
mov edi, eax
add esp, 0x14
test edi, edi
je 0x561166
push ebx
push esi
push edi
call fcn.0047d874
add esp, 0xc
push 2
push 0
call fcn.0047ce92
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x549700
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.0047c7bc
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x54973e
cmp dword [ebp + 8], 0
je 0x54972c
lea eax, [ebp + 8]
push eax
call fcn.00480c8b
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x54973e
mov eax, 4
jmp 0x54986e
call fcn.0047e148
movzx edx, al
test edx, edx
jne 0x54976c
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x54975d
mov dword [ebp - 0xc], 4
jmp 0x549764
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
jmp 0x54986e
movzx eax, byte [ebp - 1]
test eax, eax
je 0x549815
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x549bc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 8]
call fcn.0047fa6b
lea ecx, [ebp - 8]
call fcn.0047cc2b
movzx edx, al
test edx, edx
jne 0x5497d7
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.0047e2a6
mov eax, dword [ebp - 0x10]
jmp 0x54986e
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.004806ff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x549802
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.0047e2a6
mov eax, dword [ebp - 0x14]
jmp 0x54986e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
call fcn.0047e2a6
mov eax, dword [ebp - 0x18]
jmp 0x54986e
call fcn.0047c73f
movzx ecx, al
test ecx, ecx
jne 0x54984e
mov edx, dword [ebp + 0x10]
or edx, 0x200000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.0047e1b1
add esp, 0x10
jmp 0x54986e
call fcn.00480f24
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.00481136
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x5498d0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.0047c7bc
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x54990e
cmp dword [ebp + 8], 0
je 0x5498fc
lea eax, [ebp + 8]
push eax
call fcn.0047f3f4
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x54990e
mov eax, 4
jmp 0x549a3e
call fcn.0047e148
movzx edx, al
test edx, edx
jne 0x54993c
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x54992d
mov dword [ebp - 0xc], 4
jmp 0x549934
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
jmp 0x549a3e
movzx eax, byte [ebp - 1]
test eax, eax
je 0x5499e5
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x549c20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 8]
call fcn.0047fa6b
lea ecx, [ebp - 8]
call fcn.0047cc2b
movzx edx, al
test edx, edx
jne 0x5499a7
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.0047e2a6
mov eax, dword [ebp - 0x10]
jmp 0x549a3e
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.004806ff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x5499d2
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.0047e2a6
mov eax, dword [ebp - 0x14]
jmp 0x549a3e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
call fcn.0047e2a6
mov eax, dword [ebp - 0x18]
jmp 0x549a3e
call fcn.0047c73f
movzx ecx, al
test ecx, ecx
jne 0x549a1e
mov edx, dword [ebp + 0x10]
or edx, 0x200000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.0047e4b3
add esp, 0x10
jmp 0x549a3e
call fcn.00480f24
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.0047e94f
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10001450
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0xc
lea eax, [ebp - 0x14]
push 0
push eax
call dword [0x1000500c]
mov ax, word [ebp + 0xc]
add esp, 0xc
mov word [ebp - 0x10], ax
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [ebp - 0x12], ax
mov eax, dword [0x10005008]
test eax, eax
jne 0x100014a9
push 0x10005008
push 0x40000000
call dword [0x1000502c]
mov eax, dword [0x10005008]
test eax, eax
jne 0x100014a9
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 8]
mov dword [ebp - 4], ecx
xor ecx, ecx
push 0xc
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0x14]
push ecx
push 0x30303138
push 0
lea ecx, [ebp - 8]
push ecx
push eax
call dword [0x10005028]
mov esp, ebp
pop ebp
ret 8
Function at 0x4015c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 8
jmp 0x4015fb
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call eax
sub esp, 4
test ax, ax
jns 0x4015f7
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.Taste_0x_x_wird_gedrckt._n
call sym._printf
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0xff
jle 0x4015cf
mov dword [esp], 0xa
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x4015c6

Function at 0x401a50
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4063a0]
test esi, esi
jle 0x401b60
mov edi, dword [0x4063a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401a84
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401b05
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x401a70
mov dword [esp], eax
mov ebx, eax
call sym.___mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401b87
mov eax, dword [0x4063a4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
add eax, dword [edi + 0xc]
mov edx, dword [0x4063a4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401b67
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401afe
sub eax, 4
and eax, 0xfffffffb
jne 0x401b10
add dword [0x4063a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x4063a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401afe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
xor esi, esi
jmp 0x401a8e
mov eax, dword [0x4063a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
mov esi, esi
lea edi, [edi]
Function at 0x401fc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4063b0]
sub esp, 4
test ebx, ebx
je 0x402015
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40200e
test esi, esi
je 0x40200e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401ff0
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4026c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
nop
nop
nop
nop
nop
Function at 0x407830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48bfb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
push 1
mov dword [esp + 0x40], edi
call fcn.0046c04b
mov eax, dword [0x4badcc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 2
call fcn.0046dc5d
mov eax, dword [esp + 0x44]
push edi
push 0x9001
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], 3
call fcn.0046dd6f
mov ecx, dword [esi + 0x154]
push edi
push edi
push 0x18b
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, eax
mov dword [esp + 0x14], edi
cmp ebp, edi
mov dword [esp + 0x20], ebp
jle 0x4079ba
lea edx, [esp + 0x10]
lea ecx, [esi + 0x138]
push edx
push edi
call fcn.0047bd4d
mov eax, dword [esp + 0x10]
cmp dword [eax - 8], 5
jle 0x4079ad
lea ebp, [esi + 0x5c]
push 4
lea ecx, [esi + 0x62]
push str.0000
push ecx
mov byte [ebp], 0x30
call fcn.0044d5f0
add esp, 0xc
lea edx, [esp + 0x18]
lea ecx, [esp + 0x10]
push 4
push edx
call fcn.0046634a
mov eax, dword [eax]
push eax
call fcn.0044d341
add esp, 4
lea ecx, [esp + 0x18]
mov edi, eax
call fcn.0046d630
push edi
lea eax, [esp + 0x10]
push str._03d
push eax
call fcn.00466725
mov ecx, dword [esp + 0x18]
push 3
lea edx, [esi + 0x6c]
push ecx
push edx
call fcn.0044d5f0
add esp, 0x18
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x10]
push 5
push eax
call fcn.00466215
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 4
call fcn.0046d769
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 3
call fcn.0046d630
lea edx, [esi + 0x6f]
mov ecx, 0x32
mov eax, 0x20202020
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 8]
push ecx
push eax
push edx
call fcn.0044d5f0
add esp, 0xc
lea ecx, [esp + 0x24]
push 0xdb
push ebp
call fcn.0046dec6
push 2
push 0x4b8408
lea ecx, [esp + 0x2c]
call fcn.0046dec6
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
inc edi
cmp edi, ebp
mov dword [esp + 0x14], edi
jl 0x4078b4
lea ecx, [esp + 0x24]
call fcn.0046df8a
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 2
call fcn.0046dcb2
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 1
call fcn.0046d630
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 0
call fcn.0046d630
lea ecx, [esp + 0x44]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0046d630
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x40f180
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x48d048
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.0046dc5d
xor esi, esi
mov dword [esp + 0x6c], esi
call fcn.00481307
mov eax, dword [eax + 4]
push str.GridColSize.ini
add eax, 0xc0
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0046d8c5
mov eax, dword [eax]
push esi
push 0x1001
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x78], 1
call fcn.0046dd6f
lea ecx, [esp + 0xc]
mov byte [esp + 0x6c], 0
call fcn.0046d630
push esi
push 0x1000
lea ecx, [esp + 0x18]
push esi
push ecx
lea ecx, [esp + 0x30]
call fcn.004711c0
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
mov edi, dword [ebp + 0x30c]
add edx, 4
cmp edx, eax
mov byte [esp + 0x6c], 2
jbe 0x40f226
lea ecx, [esp + 0x20]
call fcn.004714d1
mov eax, dword [esp + 0x44]
mov dword [eax], edi
mov ecx, dword [esp + 0x44]
add ecx, 4
cmp edi, esi
mov dword [esp + 0x44], ecx
jle 0x40f27b
push ebx
lea ebx, [ebp + 0x26c]
push esi
mov ecx, ebx
call fcn.00421960
mov ecx, dword [esp + 0x48]
mov ebp, eax
mov eax, dword [esp + 0x4c]
add ecx, 4
cmp ecx, eax
jbe 0x40f264
lea ecx, [esp + 0x24]
call fcn.004714d1
mov edx, dword [esp + 0x48]
mov dword [edx], ebp
mov edx, dword [esp + 0x48]
add edx, 4
inc esi
cmp esi, edi
mov dword [esp + 0x48], edx
jl 0x40f242
pop ebx
lea ecx, [esp + 0x20]
call fcn.00471324
lea ecx, [esp + 0x10]
call fcn.0046df8a
lea ecx, [esp + 0x20]
mov byte [esp + 0x6c], 0
call fcn.0047129c
lea ecx, [esp + 0x10]
mov dword [esp + 0x6c], 0xffffffff
call fcn.0046dcb2
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x64
ret