joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e200
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x68], 0x10
jb 0x41deb4
mov eax, dword [esi + 0x54]
jmp 0x41deb7
lea eax, [esi + 0x54]
push 0x400
lea ecx, [esi + 0x74]
push ecx
push eax
mov eax, dword [esi + 0xc]
push 0x402
push dword [eax + 4]
call sub.WS2_32.dll_WSAAsyncGetHostByName
mov dword [esi + 0x474], eax
test eax, eax
jne 0x41deec
call sub.WS2_32.dll_WSAGetLastError
push 1
push eax
mov ecx, esi
call fcn.0041dde4
pop esi
ret
mov dword [esi + 4], 1
pop esi
ret
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x41e26e
push eax
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi + 0x10], eax
cmp eax, 0xffffffff
jne 0x41e22d
call sub.WS2_32.dll_WSAGetLastError
push 1
push eax
mov ecx, esi
call fcn.0041dde4
pop esi
ret
mov ecx, dword [esi + 0xc]
push 0x3f
push 0x401
push dword [ecx + 4]
push eax
call sub.WS2_32.dll_WSAAsyncSelect
cmp eax, 0xffffffff
je 0x41e21c
cmp dword [esi + 0x68], 0x10
jb 0x41e250
mov eax, dword [esi + 0x54]
jmp 0x41e253
lea eax, [esi + 0x54]
push eax
call sub.WS2_32.dll_inet_addr
mov dword [esi + 0x70], eax
mov ecx, esi
pop esi
cmp eax, 0xffffffff
jne 0x41e269
jmp 0x41dea6
jmp fcn.0041def5
cmp eax, 3
jne 0x41e22b
pop esi
jmp fcn.0041df72

Function at 0x423452
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x445bbc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::clear_void_]
xor ebx, ebx
push 0x63
lea eax, [ebp - 0x7b]
push ebx
push eax
mov byte [ebp - 0x7c], bl
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x64
lea eax, [ebp - 0x7c]
push eax
push 0x435d88
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4234a7
xor al, al
jmp 0x4234eb
mov ecx, dword [ebp - 0x80]
push ebx
push ebx
mov eax, ecx
shr eax, 0x18
push eax
mov edx, ecx
shr edx, 0x10
mov eax, 0xff
and edx, eax
push edx
mov edx, ecx
shr edx, 8
and edx, eax
movzx eax, cl
push edx
push eax
lea eax, [ebp - 0x18]
push str._02X_02X_02X_02X_02X_02X
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x20
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__]
mov al, 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042860c
leave
ret 4
Function at 0x42460f
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x445bbc]
xor eax, ebp
mov dword [ebp + 0x8c], eax
mov eax, dword [ebp + 0x98]
push ebx
push esi
push edi
xor esi, esi
push 0x103
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x77]
push esi
push eax
mov dword [ebp - 0x80], esi
mov byte [ebp - 0x78], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
push 1
push 0x23
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x424673
push str.c:windows_temp
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [ebp + 0x9c], esi
je 0x424699
lea eax, [ebp - 0x78]
push eax
call edi
cmp eax, 0xffffffff
jne 0x424699
push esi
lea eax, [ebp - 0x78]
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.Thunder_Network
lea eax, [ebp - 0x78]
push eax
call esi
cmp dword [ebp + 0x9c], 0
je 0x4246c6
lea eax, [ebp - 0x78]
push eax
call edi
cmp eax, 0xffffffff
jne 0x4246c6
push 0
lea eax, [ebp - 0x78]
push eax
call ebx
push 0x435e40
lea eax, [ebp - 0x78]
push eax
call esi
cmp dword [ebp + 0x9c], 0
je 0x4246ed
lea eax, [ebp - 0x78]
push eax
call edi
cmp eax, 0xffffffff
jne 0x4246ed
push 0
lea eax, [ebp - 0x78]
push eax
call ebx
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov ecx, dword [ebp + 0x8c]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042860c
add ebp, 0x90
leave
ret
Function at 0x4283c7
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x446aa8], 0
push esi
jne 0x42833a
call fcn.00428260
test eax, eax
je 0x42837d
mov eax, dword [0x446aa8]
cmp eax, 1
jne 0x42835b
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x42837d
pop esi
ret
push eax
call dword [0x446ab0]
test eax, eax
jne 0x4283c5
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x428381
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x446aa8]
call dword [0x446ab0]
mov edi, eax
test edi, edi
je 0x4283a6
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4283c2
mov edi, esi
add esi, 0xff0
push edi
push dword [0x446aa8]
call dword [0x446aac]
add edi, 0x10
cmp edi, esi
jb 0x4283ae
mov eax, edi
pop edi
pop esi
ret
jmp 0x428327

Function at 0x42860c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x445bbc]
jne 0x428616
repz ret
jmp fcn.00428f0a
Function at 0x42976d
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4297b2
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x4297b2
xor edx, edx
mov eax, esi
shl eax, 3
push 6
pop ecx
div ecx
mov ecx, esi
shl ecx, 3
mov edx, eax
imul edx, edx, 6
sub ecx, edx
dec ecx
dec ecx
je 0x4297a5
dec ecx
dec ecx
jne 0x4297a8
inc eax
inc eax
jmp 0x4297a8
add eax, 3
mov ecx, dword [ebp + 0xc]
inc eax
cmp dword [ecx], eax
jae 0x4297b9
mov dword [ecx], eax
push 0xfffffffffffffff0
pop eax
pop edi
pop esi
leave
ret
push ebx
xor edx, edx
push 3
pop ecx
mov eax, esi
div ecx
mov ecx, dword [ebp + 8]
xor edx, edx
imul eax, eax, 3
test eax, eax
jbe 0x42983d
dec eax
push 3
pop esi
div esi
inc eax
mov dword [ebp + 0x10], eax
imul eax, eax, 3
mov dword [ebp - 4], eax
movzx esi, byte [edi]
inc edi
movzx eax, byte [edi]
mov ebx, esi
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc edi
movzx edx, byte [edi]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 4
shl esi, 4
add ebx, esi
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov esi, edx
shr esi, 6
inc edi
inc ecx
mov byte [ecx], bl
lea eax, [esi + eax*4]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
and edx, 0x3f
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
dec dword [ebp + 0x10]
jne 0x4297df
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
cmp edx, esi
jae 0x429892
movzx eax, byte [edi]
inc edx
cmp edx, esi
jae 0x42984f
movzx edi, byte [edi + 1]
jmp 0x429851
xor edi, edi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
shl eax, 4
mov ebx, edi
shr ebx, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edx, esi
jae 0x42988a
and edi, 0xf
mov al, byte [edi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
jmp 0x42988d
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov edx, dword [ebp + 0xc]
mov eax, ecx
sub eax, dword [ebp + 8]
pop ebx
mov dword [edx], eax
mov byte [ecx], 0
xor eax, eax
jmp 0x4297b5
Function at 0x4298a7
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
test ebx, ebx
je 0x4299ca
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x4299ca
xor ecx, ecx
xor edi, edi
xor esi, esi
test edx, edx
jbe 0x429928
mov eax, edx
sub eax, esi
cmp eax, 2
jb 0x4298e4
cmp byte [esi + ebx], 0xd
jne 0x4298e4
cmp byte [esi + ebx + 1], 0xa
je 0x42991f
mov al, byte [esi + ebx]
cmp al, 0xa
je 0x42991f
cmp al, 0x3d
jne 0x4298f9
inc edi
cmp edi, 2
ja 0x4299ca
cmp al, 0x7f
ja 0x4299ca
movzx eax, al
mov al, byte [eax + 0x436270]
cmp al, 0x7f
je 0x4299ca
cmp al, 0x40
jae 0x42991e
test edi, edi
jne 0x4299ca
inc ecx
inc esi
cmp esi, edx
jb 0x4298ce
test ecx, ecx
jne 0x42992f
xor eax, eax
jmp 0x4299cd
imul ecx, ecx, 6
add ecx, 7
shr ecx, 3
mov eax, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], eax
jae 0x42994a
mov dword [ecx], eax
push 0xfffffffffffffff0
jmp 0x4299cc
mov eax, dword [ebp + 8]
xor edx, edx
push 3
pop edi
mov dword [ebp - 4], edx
test esi, esi
jbe 0x4299c0
mov cl, byte [ebx]
cmp cl, 0xd
je 0x4299b4
cmp cl, 0xa
je 0x4299b4
movzx ecx, cl
mov cl, byte [ecx + 0x436270]
xor ebx, ebx
cmp cl, 0x40
sete bl
movzx ecx, cl
and ecx, 0x3f
shl edx, 6
or edx, ecx
sub edi, ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jne 0x4299b1
and dword [ebp - 4], 0
test edi, edi
jbe 0x42999c
mov ecx, edx
shr ecx, 0x10
mov byte [eax], cl
inc eax
cmp edi, 1
jbe 0x4299a9
mov ecx, edx
shr ecx, 8
mov byte [eax], cl
inc eax
cmp edi, 2
jbe 0x4299b1
mov byte [eax], dl
inc eax
mov ebx, dword [ebp + 0x10]
dec esi
inc ebx
mov dword [ebp + 0x10], ebx
test esi, esi
ja 0x429959
mov ecx, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x429928
push 0xffffffffffffffee
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x429e79
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x118
sub eax, 0x80
push edi
je 0x429eb5
sub eax, 0x40
je 0x429eaa
sub eax, 0x40
je 0x429e9f
or eax, 0xffffffff
jmp 0x429f95
mov edi, dword [ebp + 8]
mov dword [edi], 0xe
jmp 0x429ebe
mov edi, dword [ebp + 8]
mov dword [edi], 0xc
jmp 0x429ebe
mov edi, dword [ebp + 8]
mov dword [edi], 0xa
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x118]
push dword [ebp + 0xc]
lea esi, [edi + 8]
push eax
mov dword [edi + 4], esi
call fcn.00429bf5
mov eax, dword [ebp - 0x118]
shl eax, 4
add eax, dword [ebp - 0x114]
add esp, 0xc
mov ecx, dword [eax]
mov dword [esi], ecx
push 4
pop ecx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
mov edi, dword [edi]
add esi, ecx
dec edi
sub eax, 0x1c
test edi, edi
jle 0x429f78
push ebx
mov dword [ebp + 0x10], ecx
movzx edx, byte [eax + 3]
movzx edx, byte [edx + str.cw]
movzx ebx, byte [eax + 2]
movzx ebx, byte [ebx + str.cw]
mov edx, dword [edx*4 + 0x4380f0]
xor edx, dword [ebx*4 + 0x437cf0]
movzx ebx, byte [eax + 1]
movzx ebx, byte [ebx + str.cw]
xor edx, dword [ebx*4 + 0x4378f0]
mov ebx, dword [eax]
and ebx, 0xff
movzx ebx, byte [ebx + str.cw]
xor edx, dword [ebx*4 + 0x4374f0]
add eax, ecx
mov dword [esi], edx
add esi, ecx
dec dword [ebp + 0x10]
jne 0x429f18
dec edi
sub eax, 0x20
test edi, edi
jg 0x429f15
pop ebx
mov edx, dword [eax]
mov dword [esi], edx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
add esi, ecx
add eax, ecx
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
xor eax, eax
pop esi
pop edi
leave
ret
Function at 0x42ac22
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x445bbc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x42ac50
xor al, al
jmp 0x42acaf
push 0x228
lea eax, [ebp - 0x22c]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x42ac9e
lea eax, [ebp - 0x20c]
push eax
push edi
call sub.MSVCR90.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x42aca4
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42ac7e
jmp 0x42aca6
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042860c
leave
ret

Function at 0x42af7b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
mov esi, ecx
lea ecx, [esi + 8]
mov dword [esi + 4], eax
call dword [0x434330]
push dword [ebp + 0x10]
lea ecx, [esi + 0x24]
call fcn.00417dda
push dword [ebp + 0x14]
lea ecx, [esi + 0x3c]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x64], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x68], eax
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x6c], eax
xor eax, eax
push eax
push eax
push esi
push 0x42acfb
push eax
push eax
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov al, 1
pop esi
pop ebp
ret 0x1c
Function at 0x42cf90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0x438f4c
push dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 4], edi
call dword [sym.imp.MSVCR90.dll__wfopen]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x42cfd4
push ebx
push 1
push 2
push 0x4385e0
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, 1
je 0x42cfdd
push ebx
call dword [sym.imp.MSVCR90.dll_fclose]
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
lea esi, [edi + 4]
push esi
push dword [esi + 0xc]
lea ecx, [ebp - 0x14]
call fcn.00424d5f
push esi
push dword [esi + 0x10]
lea ecx, [ebp - 0x24]
call fcn.00424d5f
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
call fcn.004248f0
test al, al
jne 0x42d0d9
mov edi, dword [sym.imp.MSVCR90.dll_fwprintf]
lea ecx, [ebp - 0x14]
call fcn.00424891
mov esi, eax
cmp dword [esi + 0x18], 8
jb 0x42d027
mov eax, dword [esi + 4]
jmp 0x42d02a
lea eax, [esi + 4]
push eax
push str.__s__r_n
push ebx
call edi
add esp, 0xc
test eax, eax
jl 0x42cfcc
add esi, 0x1c
push esi
push dword [esi + 0xc]
lea ecx, [ebp - 0xc]
call fcn.00424d5f
push esi
push dword [esi + 0x10]
lea ecx, [ebp - 0x1c]
call fcn.00424d5f
jmp 0x42d098
lea ecx, [ebp - 0xc]
call fcn.00424891
cmp dword [eax + 0x34], 8
jb 0x42d06a
mov ecx, dword [eax + 0x20]
jmp 0x42d06d
lea ecx, [eax + 0x20]
cmp dword [eax + 0x18], 8
jb 0x42d078
mov eax, dword [eax + 4]
jmp 0x42d07b
add eax, 4
push ecx
push eax
push str._s_s_r_n
push ebx
call edi
add esp, 0x10
test eax, eax
jl 0x42cfcc
lea ecx, [ebp - 0xc]
call fcn.0041b830
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xc]
call fcn.004248f0
test al, al
je 0x42d057
push 0x438600
push ebx
call edi
pop ecx
pop ecx
test eax, eax
jl 0x42cfcc
lea ecx, [ebp - 0x14]
call fcn.0042bcc4
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
call fcn.004248f0
test al, al
je 0x42d012
mov edi, dword [ebp - 4]
push ebx
call dword [sym.imp.MSVCR90.dll_fclose]
pop ecx
mov byte [edi + 0x3c], 0
mov al, 1
jmp 0x42cfd6
Function at 0x42f2ea
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
call fcn.0042e8fd
push 0x438f54
push dword [ebp + 8]
call dword [sym.imp.MSVCR90.dll__wfopen]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42f368
and dword [ebp - 4], 0
push edi
push esi
push 1
lea eax, [ebp - 4]
push 2
push eax
call dword [sym.imp.MSVCR90.dll_fread]
push esi
mov edi, eax
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 0x14
cmp edi, 1
pop edi
jne 0x42f364
mov eax, 0xfeff
cmp word [ebp - 4], ax
je 0x42f358
cmp word [ebp - 4], 0x5b
je 0x42f358
cmp word [ebp - 4], 0x7f
jbe 0x42f358
push dword [ebp + 8]
mov ecx, ebx
call fcn.0042eb98
jmp 0x42f36a
push dword [ebp + 8]
mov ecx, ebx
call fcn.0042ef1e
jmp 0x42f36a
mov al, 1
jmp 0x42f36a
xor al, al
pop esi
pop ebx
leave
ret 4

Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x28c20410
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..text
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x1b0201e5
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x402450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402469
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4024a4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4024a0
lea ebx, [ebx]
cmp esi, eax
jae 0x4024a4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402490
cmp esi, eax
jb 0x4024aa
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x407ddf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0041a247
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x407e18
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00407a2b
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x407e76
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x407e9a
cmp dword [edi + 0x54], 0
jne 0x407e9a
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0041a247
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00407e37
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40875b
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x52be06
call fcn.00505e40
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x408780
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4087c6
lea ecx, [ebp - 0x10]
call fcn.00401140
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407eea
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004011b0
mov eax, esi
call fcn.00505f18
ret 8

Function at 0x40eed4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40ef1b
call fcn.0041a247
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40ef1b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40ef37
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040ea4c
mov esi, eax
test edi, edi
je 0x40ef35
test ebx, ebx
je 0x40ef35
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4174c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x417508
call fcn.0041a247
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x417508
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41754b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x417534
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x417534
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x417548
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4218c4
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x578700]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi - 0x60]
mov ebx, 0x8000
cmp eax, 9
ja 0x4218fd
push 0x12
call esi
mov ecx, ebx
test cx, ax
je 0x421924
cmp dword [0x57c4c0], 0
jne 0x421924
lea eax, [edi - 0x41]
cmp eax, 0x19
jbe 0x421917
push 0x12
call esi
test bx, ax
je 0x42191b
mov eax, edi
jmp 0x421993
push edi
call fcn.0050939b
pop ecx
jmp 0x421993
push 4
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.005059e0
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x42194d
call fcn.00411d36
call fcn.00418b81
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 2
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [ebp - 0x108]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00505162
leave
ret 4