joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414da0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x4ceb90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [0x4d05ac], 0
push 0x4d0650
push 0xffffffffffffffff
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
mov ecx, 0x27
mov esi, 0x4d0650
mov edi, 0x4d05b0
rep movsd dword es:[edi], dword [esi]
cmp dword [0x4d06bc], 0x500
jb 0x414df7
cmp dword [0x4d06c0], 0x2d0
jae 0x414e18
push 0
mov ecx, 0x47c64f8
call fcn.00411310
push eax
push 0x4c1938
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.0049eddc
mov dword [ebp - 0xa8], 0
lea eax, [ebp - 0xa0]
push eax
mov ecx, dword [ebp - 0xa8]
push ecx
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
test eax, eax
je 0x414e4d
mov edx, dword [ebp - 0xa8]
add edx, 1
mov dword [ebp - 0xa8], edx
jmp 0x414e22
mov eax, dword [ebp - 0xa8]
add eax, 1
xor ecx, ecx
mov edx, 0x9c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049b000
add esp, 4
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], 0
imul ecx, dword [ebp - 0xa8], 0x9c
add ecx, dword [ebp - 0xa4]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
test eax, eax
je 0x414ec0
mov eax, dword [ebp - 0xa8]
add eax, 1
mov dword [ebp - 0xa8], eax
jmp 0x414e8b
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xac], 0
jmp 0x414ee5
mov ecx, dword [ebp - 0xac]
add ecx, 1
mov dword [ebp - 0xac], ecx
mov edx, dword [ebp - 0xac]
cmp edx, dword [ebp - 0xa8]
jge 0x414fe6
imul eax, dword [ebp - 0xac], 0x9c
mov ecx, dword [ebp - 0xa4]
cmp dword [ecx + eax + 0x6c], 0x500
jne 0x414fe1
imul edx, dword [ebp - 0xac], 0x9c
mov eax, dword [ebp - 0xa4]
cmp dword [eax + edx + 0x70], 0x2d0
jne 0x414fe1
imul ecx, dword [ebp - 0xac], 0x9c
mov edx, dword [ebp - 0xa4]
cmp dword [edx + ecx + 0x68], 0x20
jne 0x414fe1
push 0x4d0650
imul eax, dword [ebp - 0xac], 0x9c
add eax, dword [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x414fe1
push 2
imul ecx, dword [ebp - 0xac], 0x9c
add ecx, dword [ebp - 0xa4]
push ecx
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
test eax, eax
jne 0x414fe1
imul esi, dword [ebp - 0xac], 0x9c
add esi, dword [ebp - 0xa4]
mov ecx, 0x27
mov edi, 0x4d0650
rep movsd dword es:[edi], dword [esi]
mov dword [0x4d064c], 1
cmp dword [ebp - 0xa4], 0
je 0x414fdf
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0xb4], edx
mov eax, dword [ebp - 0xb4]
push eax
call fcn.0049affb
add esp, 4
mov dword [ebp - 0xa4], 0
jmp 0x415014
jmp 0x414ed6
cmp dword [ebp - 0xa4], 0
je 0x415014
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0xb8], ecx
mov edx, dword [ebp - 0xb8]
push edx
call fcn.0049affb
add esp, 4
mov dword [ebp - 0xa4], 0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ad38
mov esp, ebp
pop ebp
ret
Function at 0x43a6e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x4ceb90]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1b4], ecx
push 0x64
lea eax, [ebp - 0x194]
push eax
mov ecx, dword [ebp - 0x1b4]
mov edx, dword [ecx + 0x234]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x19c], 0
mov ecx, 1
imul edx, ecx, 0
mov dword [ebp - 0x1a4], edx
cmp dword [ebp - 0x1a4], 0xc8
jae 0x43a758
jmp 0x43a75d
call fcn.0049b12a
mov eax, dword [ebp - 0x1a4]
mov byte [ebp + eax - 0xcc], 0
mov ecx, dword [ebp - 0x198]
cmp ecx, dword [ebp - 0x1b8]
jge 0x43a870
mov edx, dword [ebp - 0x198]
movsx eax, byte [ebp + edx - 0x194]
and eax, 0xff
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x81
jl 0x43a7ae
cmp dword [ebp - 0x1a0], 0x9f
jle 0x43a7ce
cmp dword [ebp - 0x1a0], 0xe0
jl 0x43a85c
cmp dword [ebp - 0x1a0], 0xfc
jg 0x43a85c
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ebp - 0x198]
mov al, byte [ebp + edx - 0x194]
mov byte [ebp + ecx - 0xcc], al
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x198]
add edx, 1
mov dword [ebp - 0x198], edx
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x198]
mov dl, byte [ebp + ecx - 0x194]
mov byte [ebp + eax - 0xcc], dl
mov eax, dword [ebp - 0x19c]
add eax, 1
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x1a8], ecx
cmp dword [ebp - 0x1a8], 0xc8
jae 0x43a849
jmp 0x43a84e
call fcn.0049b12a
mov edx, dword [ebp - 0x1a8]
mov byte [ebp + edx - 0xcc], 0
mov eax, dword [ebp - 0x198]
add eax, 1
mov dword [ebp - 0x198], eax
jmp 0x43a76b
lea ecx, [ebp - 0xcc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jg 0x43a883
jmp 0x43a8c4
lea edx, [ebp - 0xcc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x64
jle 0x43a8c4
mov eax, 1
imul ecx, eax, 0x64
mov dword [ebp - 0x1ac], ecx
cmp dword [ebp - 0x1ac], 0xc8
jae 0x43a8b1
jmp 0x43a8b6
call fcn.0049b12a
mov edx, dword [ebp - 0x1ac]
mov byte [ebp + edx - 0xcc], 0
mov ecx, 0x4d0938
call fcn.0041de60
mov dword [ebp - 0x1b0], eax
lea eax, [ebp - 0xcc]
push eax
imul ecx, dword [ebp + 8], 0x3bd68
mov edx, dword [ebp - 0x1b0]
lea eax, [edx + ecx + 9]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x43a8f9
jmp 0x43a922
lea ecx, [ebp - 0xcc]
push ecx
imul edx, dword [ebp + 8], 0x3bd68
mov eax, dword [ebp - 0x1b0]
lea ecx, [eax + edx + 9]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x4d0938
call fcn.0046c5e0
mov ecx, dword [ebp - 0x1b4]
call fcn.004383e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ad38
mov esp, ebp
pop ebp
ret 4
Function at 0x45e660
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4ceb90]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x110], ecx
mov eax, dword [0x4c3ec0]
mov dword [ebp - 0x114], eax
mov byte [ebp - 0x109], 0x61
jmp 0x45e69c
mov cl, byte [ebp - 0x109]
add cl, 1
mov byte [ebp - 0x109], cl
movsx edx, byte [ebp - 0x109]
cmp edx, 0x7a
jg 0x45e737
push 5
movzx eax, byte [ebp - 0x109]
push eax
mov ecx, dword [ebp - 0x110]
call fcn.0045e750
movzx ecx, al
cmp ecx, 1
jne 0x45e732
mov edx, 1
imul eax, edx, 0
mov cl, byte [ebp - 0x109]
mov byte [ebp + eax - 0x114], cl
push 0
push 0
push 0
push 0
push 0
push 0x104
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [ebp - 0x110]
add ecx, 0x38
mov edx, dword [ebp - 0x110]
mov eax, dword [edx + 0x38]
mov edx, dword [eax + 0xc]
call edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x45e732
mov al, byte [ebp - 0x109]
jmp 0x45e739
jmp 0x45e68d
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ad38
mov esp, ebp
pop ebp
ret

Function at 0x45e750
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [0x4c3ec4]
mov dword [ebp - 4], eax
mov ecx, 1
imul edx, ecx, 0
mov al, byte [ebp + 8]
mov byte [ebp + edx - 4], al
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, dword [ebp + 0xc]
jne 0x45e783
mov al, 1
jmp 0x45e785
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x45fb60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x4ceb90]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x410], ecx
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x5a4], ecx
mov edx, dword [ebp - 0x410]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x5a8], eax
mov ecx, dword [ebp - 0x410]
cmp dword [ecx + 0x5a4], 9
je 0x45fbb5
mov edx, dword [ebp - 0x410]
cmp dword [edx + 0x5a4], 0xe
jne 0x45fbf9
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + 0x5a8]
mov dword [ebp - 0x414], ecx
cmp dword [ebp - 0x414], 9
jl 0x45fbdd
cmp dword [ebp - 0x414], 0x12
jle 0x45fbdb
jmp 0x45fbdd
jmp 0x45fbf7
mov edx, dword [ebp - 0x410]
cmp dword [edx + 0x5a8], 1
je 0x45fbf7
mov ecx, dword [ebp - 0x410]
call fcn.0045f6f0
jmp 0x45fc23
mov ecx, dword [ebp - 0x410]
call fcn.0045fb30
push str.cgpSaveThumbChange.png
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
movzx edx, byte [ebp + 0x10]
cmp edx, 1
jne 0x45fc3c
mov ecx, dword [ebp - 0x410]
call fcn.0045fd80
jmp 0x45fd66
lea ecx, [ebp - 0x40c]
call fcn.004122b0
push 0x304
push 0
lea eax, [ebp - 0x40c]
push eax
call fcn.0049c5e0
add esp, 0xc
mov dword [ebp - 0x40c], 0x1964
xorps xmm0, xmm0
movss dword [ebp - 0x3f0], xmm0
xorps xmm0, xmm0
movss dword [ebp - 0x3ec], xmm0
xorps xmm0, xmm0
movss dword [ebp - 0x3e8], xmm0
mov dword [ebp - 0x3d0], 0x500
mov dword [ebp - 0x3cc], 0x2d0
mov dword [ebp - 0x3c8], 0
mov dword [ebp - 0x3c4], 0
mov dword [ebp - 0x3c0], 0x500
mov dword [ebp - 0x3bc], 0x2d0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x424]
call fcn.00411280
mov ecx, dword [eax]
mov dword [ebp - 0x3e0], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x3dc], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x3d8], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x3d4], edx
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x408], 0x6d
mov byte [ebp - 0x3fc], 1
lea eax, [ebp - 0x40c]
push eax
mov ecx, 0x484d928
call fcn.004404d0
push ecx
movss xmm0, dword [0x4c7364]
movss dword [esp], xmm0
push 0xc8
mov ecx, dword [ebp - 0x40c]
push ecx
mov ecx, 0x484d928
call fcn.00444ea0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ad38
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4637e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x18
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x18]
mov eax, dword [edx + 0xc]
call eax
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str._bgm_
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x463875
push str._:_setup_bgm_
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 4]
call fcn.0045e660
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
mov byte [ecx + edx], al
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x463875
xor al, al
jmp 0x463877
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x46f630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4ceb90]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
xor edx, edx
mov word [ebp - 0x14], dx
mov eax, 1
mov word [ebp - 0x12], ax
xor ecx, ecx
mov word [ebp - 0x10], cx
xor edx, edx
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
xor ecx, ecx
mov word [ebp - 0xa], cx
xor edx, edx
mov word [ebp - 8], dx
mov eax, 1
mov word [ebp - 6], ax
cmp dword [ebp + 0x18], 0
jne 0x46f696
xor eax, eax
jmp 0x46f6fb
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.0049b000
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
jne 0x46f6d6
push 0x30
mov ecx, 0x47c64f8
call fcn.00411310
push eax
push 0x4c4888
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.0049eddc
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 6
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.GDI32.dll_GetGlyphOutlineA]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ad38
mov esp, ebp
pop ebp
ret 0x14
Function at 0x474700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ecx
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 8]
test ecx, ecx
je 0x4747ce
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4747cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4747c1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x10], 0
jne 0x47479e
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
add eax, 0x28
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x4747bf
cmp dword [ebp - 0x10], 0x102
jne 0x4747b4
mov byte [ebp - 1], 4
mov eax, dword [ebp - 8]
mov byte [eax + 8], 0
jmp 0x4747bf
mov byte [ebp - 1], 5
mov ecx, dword [ebp - 8]
mov byte [ecx + 8], 0
jmp 0x4747cc
mov byte [ebp - 1], 5
mov edx, dword [ebp - 8]
mov byte [edx + 8], 0
jmp 0x4747d2
mov byte [ebp - 1], 2
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 8

Function at 0x4747e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4ceb90]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.004742b0
mov eax, dword [ebp - 0x18]
mov dword [eax], vtable.COnahole.0
mov ecx, dword [ebp - 0x18]
mov byte [ecx + 0x70], 0
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x68], 0
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x6c], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0x3c
mov byte [ebp - 0x12], 0x30
mov byte [ebp - 0x11], 0x31
mov byte [ebp - 0x10], 0x35
mov byte [ebp - 0xf], 0x32
mov byte [ebp - 0xe], 0x30
mov byte [ebp - 0xd], 0x30
mov byte [ebp - 0xc], 0x30
mov byte [ebp - 0xb], 0x30
mov byte [ebp - 0xa], 0x30
mov byte [ebp - 9], 1
mov byte [ebp - 8], 2
mov byte [ebp - 7], 3
mov byte [ebp - 6], 0x68
mov byte [ebp - 5], 0x3e
mov ecx, dword [ebp - 0x18]
add ecx, 0x48
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0xc]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 8]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ad38
mov esp, ebp
pop ebp
ret
Function at 0x475280
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b2560
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4ceb90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.MOSceMain.0
mov ecx, dword [ebp - 0x10]
call fcn.004753e0
push 0x4819a0
push 0x64
push 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x3eae54
push ecx
call fcn.0049b204
push 0x481aa0
push 0xa
push 8
mov edx, dword [ebp - 0x10]
add edx, 0x3ead38
push edx
call fcn.0049b204
mov ecx, dword [ebp - 0x10]
add ecx, 0x3ead30
call fcn.00481b70
mov ecx, dword [ebp - 0x10]
add ecx, 0x3ead28
call fcn.00481b70
mov ecx, dword [ebp - 0x10]
add ecx, 0x3ead20
call fcn.00481b70
mov ecx, dword [ebp - 0x10]
add ecx, 0x3ead18
call fcn.00481b70
mov ecx, dword [ebp - 0x10]
add ecx, 0x3ead10
call fcn.00481b70
mov ecx, dword [ebp - 0x10]
add ecx, 0x313bcc
call fcn.00492130
mov ecx, dword [ebp - 0x10]
add ecx, 0x313bb0
call fcn.00494740
mov ecx, dword [ebp - 0x10]
add ecx, 0xc7428
call fcn.00494450
mov ecx, dword [ebp - 0x10]
add ecx, 0xc7404
call fcn.00491b80
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call fcn.00494740
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.004945e0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00494740
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00492480
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x494250
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x494265
lea eax, [ecx + 0xc]
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 8]
test eax, eax
jne 0x494276
mov eax, 3
pop esi
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x494285
lea eax, [edx + 2]
pop esi
pop ebp
ret 8
push edi
push 0
lea edi, [ebp + 8]
push edi
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
cmp eax, 1
jne 0x4942b8
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4942ae
mov dword [esi + 0xc], 1
pop esi
pop ebp
ret 8
add dword [esi + 8], eax
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, 0xe
pop esi
pop ebp
ret 8

Function at 0x4942d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x4942e5
lea eax, [ecx + 0xc]
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4942f6
mov eax, 3
pop esi
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x494305
lea eax, [edx + 2]
pop esi
pop ebp
ret 8
push edi
push 0
lea edi, [ebp + 8]
push edi
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
cmp eax, 1
jne 0x494338
mov eax, dword [ebp + 8]
test eax, eax
jne 0x49432e
mov dword [esi + 0xc], 1
pop esi
pop ebp
ret 8
add dword [esi + 8], eax
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, 0xe
pop esi
pop ebp
ret 8
Function at 0x510024
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
add al, byte [eax]
add byte [eax], al
cld
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
cld
invalid
stc
jb 0x51002e
pop ds
xor esi, dword [ecx - 0x49]
jno 0x50ffe2
cwde
leave
jmp 0x51008f
pushal
jmp 0x510034
call 0x51003f
dec ecx
stc
mov dl, 0xed
pop ecx
pop ebx
jb 0x510049
jne 0x50ffd9
jge 0x510029
sbb dword [edx - 0x383c7edc], 0xffffffff
invalid
add ebx, 0xffffffc7
jmp 0x510058
cmp dword [ebx], 0
stc
jmp 0x510067
je 0x5100ed
jmp 0x510076
mov ecx, ebx
jmp 0x510081
add ebx, 4
jmp 0x510089
mov edx, dword [ebx]
jmp 0x510097
and eax, 0x8ced9cec
in eax, dx
cmp ebp, dword [ebx + 3]
sar ecx, cl
add edx, ebx
stc
jb 0x5100a3
mov ah, 0xb1
mov ebx, 0xc91a740d
mov eax, dword [ebx + 4]
jmp 0x5100ac
sub dword [edx], 0x3c62176a
jmp 0x5100b6
add edx, 4
jmp 0x5100bf
sub eax, 1
jmp 0x5100c6
jne 0x5100a6
jmp 0x5100d0
add ebx, 8
jmp 0x5100d7
sub dword [ecx], 1
stc
jb 0x5100de
and ecx, dword [edi]
test dword [eax + 0x72ffffff], esp
add dh, byte [ecx + 0xee83b]
add byte [eax], al
jne 0x510084
jb 0x5100e8
mov cl, 0x3b
call 0x5100fb
jmp 0x5100f1
popal
jmp 0x5100f6
jmp 0x50ed00

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push 0xcec00
push 0
call sub.user32.dll_GetOpenClipboardWindow
call sub.kernel32.dll_VirtualAlloc
call fcn.0049f726
ret

Function at 0x49f726
Capabilities:
Encode data using xor

Disassembly:
jmp 0x49f745
mov al, byte [esi]
nop
xor al, dl
mov byte [edi], al
inc edx
inc esi
inc edi
dec ecx
nop
cmp ecx, 0
jne 0x49f72b
jmp 0x49f765
sub esp, 0x34c
mov esi, 0x5d1428
jmp 0x49f755
mov edi, 0x4aa2dc
mov dword [edi], eax
nop
mov edi, eax
nop
jmp 0x49f774
call ebx
add esp, 0x34c
ret
mov ebx, edi
mov ecx, 0x34c
mov edx, 0xc4
jmp 0x49f72b
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xbc37ac3
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x18a21fba
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x10001060
Capabilities:
Create thread
Log keystrokes via polling
Read file via mapping
Terminate thread

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
push 0
push 0
push 0
push 6
push edi
mov dword [0x10005380], 0xcc
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [0x10005384], eax
jne 0x10001090
mov eax, 0xc9
pop edi
pop ecx
ret
cmp dword [esp + 0x10], 4
jae 0x100010ad
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xcb
pop edi
pop ecx
ret
mov eax, dword [0x10005390]
test eax, eax
jne 0x100010d2
push str.TerminateThread
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10005390], eax
mov eax, dword [esp + 0x18]
push 4
push eax
mov dword [0x10005388], eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x10001103
mov eax, dword [0x10005384]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xe1
pop edi
pop ecx
ret
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x10001020
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x1000538c], eax
jne 0x10001140
mov edx, dword [0x10005384]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xcd
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor esi, esi
test ebx, ebx
jbe 0x100011b2
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x11
call edi
test ax, ax
jge 0x1000116b
push 0x7b
call edi
test ax, ax
jl 0x10001180
mov eax, dword [0x1000538c]
push 0x32
push eax
call ebp
test eax, eax
je 0x10001198
inc esi
cmp esi, ebx
jb 0x10001159
jmp 0x100011ae
mov ecx, dword [0x1000538c]
push 0xd3
mov dword [0x10005380], 0xd3
push ecx
jmp 0x100011a4
mov edx, dword [0x1000538c]
push 0xce
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp esi, ebx
jb 0x100011cf
mov edi, dword [esp + 0x18]
mov eax, dword [0x1000538c]
push 0xd5
push eax
mov dword [0x10005380], 0xd5
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x100011d3
mov edi, dword [esp + 0x18]
mov ecx, dword [0x10005384]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10005380]
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret