joyce8/EMBER2024-capa huggingface dataset:
Function at 0x25b5e24
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x25b5e42
cmp dword [esi + 0x78], 0
je 0x25b5e42
push 2
push 3
push esi
call fcn.025b2634
add esp, 0xc
push dword [ebp + 0xc]
call fcn.025b5824
add esp, 4
test esi, esi
je 0x25b5e62
cmp dword [esi + 0x78], 0
je 0x25b5e62
push 3
push esi
call fcn.025b2674
add esp, 8
pop esi
pop ebp
ret
Function at 0x25c19e4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.025e4fc8
add esp, 0x18
test eax, eax
je 0x25c1a06
cmp eax, 0xffffffff
jne 0x25c1a08
xor eax, eax
pop ebp
ret

Function at 0x25c76c4
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, 0x51eb851f
imul ecx
push ebx
sar edx, 5
push esi
mov esi, dword [ebp + 8]
mov eax, edx
shr eax, 0x1f
push edi
add eax, edx
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 2
je 0x25c7701
push 0x100861ec
push esi
call fcn.025add44
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x25c7718
push ecx
push 0x10086208
push esi
call fcn.025ade04
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x25c7731
push ebx
push esi
call fcn.025c7384
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x25c7746
push esi
call fcn.025c63b4
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x25c775b
push esi
call fcn.025c7364
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x25c776b
push esi
call fcn.025c75a4
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x25dde94
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x100928cc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x25ddec1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x25ddf08
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x25ddf0e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x25ddf6e
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ebx, [ebx]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
dec dword [ebp + 0x10]
jne 0x25ddf34
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x25ddf9b
nop
mov eax, dword [esi + 4]
push 1
push 0x10089165
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x10089164
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x25ddf74
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x2657cf0
Capabilities:
Encode data using xor

Disassembly:
and byte [eax], 0x59
sub byte [esi], dh
dec esp
sahf
into
adc al, al
inc esp
cld
lahf
mov eax, 0xe84b7018
mov ecx, dword [esi + 0x54990562]
mov dword [ebp - 0x1047e341], esp
jecxz 0x2657ce0
popfd
push ds
pop edx
sub byte [edx - 0xa396914], ah
ficomp word [edi]
mov dh, 0x95
sbb byte [edx - 0x3de40a0e], bl
insd dword es:[edi], dx
adc al, 0x5f
std
push edi
test dword [edx - 0x5c5a4280], eax
pop ebx
cmpsb byte [esi], byte es:[edi]
cdq
fcmovnu st(0), st(4)
ja 0x2657c61
sar esp, 1
test al, 0xa5
enter 0xffffffffffffb1ec, 0xffffffffffffffc9
add bl, byte [esi + eax*2 - 0x4ea24d65]
std
mov byte [esi - 0x22044e88], dl
movsd dword es:[edi], dword [esi]
jns 0x2657cab
mov edx, 0x7ab2efa5
in al, dx
test ebx, ebx
push eax
pop edx
pop edx
rep lodsb al, byte [esi]
push es
cmp al, 0x5a
mov eax, 0x22bf7160
int 0x72
out dx, eax
insd dword es:[edi], dx
jge 0x2657c42
sub byte [eax], ch
adc byte [ebx], dh
in eax, dx
sbb dword [eax + 0x5a], eax
hlt
inc esp
test cl, ah
xchg esp, eax
mov bh, 0x5c
jns 0x2657c7a
lodsd eax, dword [esi]
nop
xor ecx, dword [ebx + esi*2 - 0x67]
jb 0x2657d1f
invalid
pop ecx
pop ecx
test al, 0x53
push esp
or byte [edi + ecx*2], bh
mov dword [0xd9225a5f], eax
cmp al, 0xeb
cmp dword [edi - 0xe], edx
aas
loopne 0x2657cf4
jg 0x2657cad
leave
sub eax, 0x3759159a
salc
aad 0xb0
movsd dword es:[edi], dword [esi]
push ebp
insb byte es:[edi], dx
xchg ebp, eax
push esp
mov ch, 0x2e
xor eax, 0xc22b5a34
push es
xor byte [edx + edx*8 - 0x62], dh
lahf
add eax, dword [ecx]
pop esi
rcr byte [esi + 0x5e01039f], cl
invalid
Function at 0x62c1163d
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
cmp ebx, edi
jne 0x62c1165d
mov eax, 0x100
jmp 0x62c1174e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x64
push edi
call esi
cmp eax, edi
mov dword [ebp + 0xc], eax
jne 0x62c11678
push 2
pop esi
jmp 0x62c11728
push 1
push 0
call esi
test eax, eax
mov dword [ebx], eax
je 0x62c1171c
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push eax
lea ecx, [ebp - 0x110]
push ecx
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x62c11711
cmp eax, 0xffffffff
je 0x62c11718
push 0
push 0x64
push dword [ebp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
je 0x62c11718
test esi, esi
je 0x62c1173c
lea eax, [esi + edi]
mov dword [ebp - 4], eax
push 2
inc eax
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
test eax, eax
je 0x62c1171c
mov ecx, esi
mov esi, dword [ebp + 0xc]
add edi, eax
mov dword [ebx], eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 4]
jmp 0x62c11688
mov esi, 0xc004
jmp 0x62c1171f
push 3
jmp 0x62c1171e
push 2
pop esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebx]
test eax, eax
je 0x62c11738
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebx], 0
mov eax, esi
jmp 0x62c1174d
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebx]
mov byte [edi + eax], 0
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x62c11759
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x62c110e0
push 0x80000002
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x62c1178a
mov eax, dword [ebp + 0xc]
and dword [eax], 0
xor eax, eax
jmp 0x62c117c3
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push dword [ebp - 4]
je 0x62c117b9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [esi], 0
xor eax, eax
jmp 0x62c117c2
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop esi
leave
ret 8
Function at 0x62c11a21
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x20]
xor eax, eax
cmp dword [ebp + 0x10], eax
push edi
mov edi, dword [esi + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov dword [ebp + 8], eax
jg 0x62c11a57
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
lea ecx, [ebp - 8]
push ecx
push eax
lea ecx, [ebp - 0x10c]
push ecx
push eax
push eax
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x10c], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x62c11aae
cmp eax, 0xffffffff
je 0x62c11ab7
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 8]
push eax
push ebx
push edi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x62c11ab7
add dword [ebp + 8], eax
and dword [esi + 0x30], 0
add ebx, eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x10]
jl 0x62c11a55
jmp 0x62c11a4b
mov dword [esi + 0x30], 0x4000
jmp 0x62c11abe
mov dword [esi + 0x30], 3
or eax, 0xffffffff
jmp 0x62c11a4e

Function at 0x62c11ac8
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62c13020]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10c], eax
mov eax, dword [esi + 0x10]
push edi
mov dword [ebp - 0x20c], eax
xor edi, edi
lea eax, [ebp - 0x10c]
push eax
push edi
push edi
lea eax, [ebp - 0x210]
push eax
push edi
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x210], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, edi
jne 0x62c11b26
mov eax, 0xc004
jmp 0x62c11b60
cmp eax, 0xffffffff
je 0x62c11b4e
push edi
push 0xff
lea eax, [ebp - 0x104]
push eax
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, edi
jne 0x62c11b49
push 4
jmp 0x62c11b50
cmp eax, 0xffffffff
jne 0x62c11b53
push 3
pop eax
jmp 0x62c11b60
mov al, byte [ebp - 0x104]
neg al
sbb eax, eax
and eax, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.62c124d5
leave
ret 8

Function at 0x62c11b73
Capabilities:
Connect socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x62c13020]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
jmp 0x62c11bb9
mov eax, dword [esi + 0x18]
mov cx, word [ebp + 0xc]
mov word [eax + 2], cx
push dword [esi + 0x10]
push dword [esi + 0x18]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x62c11bd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esi + 0x1c]
mov dword [ebp - 0x40c], eax
test esi, esi
jne 0x62c11b8c
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 4]
pop esi
call fcn.62c124d5
leave
ret 0xc
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x408]
push eax
push 0
mov dword [ebp - 0x410], 0x401
push dword [esi + 0x10]
push dword [esi + 0x18]
call dword [sym.imp.WS2_32.dll_WSAAddressToStringA]
xor eax, eax
jmp 0x62c11bc3
Function at 0x62c11d8d
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4a0
mov eax, dword [0x62c13020]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi + 8]
mov dword [ebp - 4], eax
call fcn.62c119f9
mov edi, eax
test edi, edi
jne 0x62c11dbb
push 3
pop eax
jmp 0x62c11f84
mov eax, dword [esi + 4]
test eax, eax
je 0x62c11dcd
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
and dword [esi + 4], 0
and dword [ebp - 0x490], 0
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], edi
mov dword [ebp - 0x494], 1
mov edx, dword [esi + 4]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x498], eax
xor eax, eax
push 0x20
pop ecx
lea edi, [ebp - 0x488]
rep stosd dword es:[edi], eax
mov eax, dword [edx + 0x18]
mov ax, word [eax]
xor edi, edi
inc edi
mov word [ebp - 0x488], ax
mov dword [ebp - 0x4a0], edi
mov dword [ebp - 0x48c], 0x2d1
mov eax, dword [esi + 4]
push 0
push edi
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
je 0x62c11f66
push 4
lea ecx, [ebp - 0x4a0]
push ecx
push 4
push 0xffff
push eax
mov dword [esi + 0x14], edi
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [ebp - 0x48c]
call dword [sym.imp.WS2_32.dll_htons]
cmp dword [esi + 0xc], 0
mov word [ebp - 0x486], ax
je 0x62c11e77
and word [ebp - 0x486], 0
push dword [ebp - 0x498]
lea eax, [ebp - 0x488]
push eax
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x62c11eb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2740
jne 0x62c11ea4
cmp dword [esi + 0xc], 0
je 0x62c11f02
push dword [esi + 0x10]
call ebx
push 3
pop eax
jmp 0x62c11f7b
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x408]
push eax
push 0
push dword [ebp - 0x498]
lea eax, [ebp - 0x488]
push eax
mov dword [ebp - 0x49c], 0x401
call dword [sym.imp.WS2_32.dll_WSAAddressToStringA]
push dword [esi + 4]
xor eax, eax
mov ax, word [esi + 0x28]
mov dword [esi + 0x14], 2
push eax
push dword [esi + 0x10]
call fcn.62c11b73
test eax, eax
je 0x62c11f6b
cmp eax, 0x2740
jne 0x62c11f26
push dword [esi + 0x10]
call ebx
or dword [esi + 0x10], 0xffffffff
and dword [esi + 0x14], 0
inc dword [ebp - 0x48c]
cmp word [ebp - 0x48c], 0x2db
jbe 0x62c11e21
jmp 0x62c11f3a
push dword [esi + 0x10]
call ebx
or dword [esi + 0x10], 0xffffffff
and dword [esi + 0x14], 0
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0
je 0x62c11f76
cmp dword [ebp - 0x490], 0xb4
ja 0x62c11f76
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
add dword [ebp - 0x490], 5
jmp 0x62c11de8
push 3
pop eax
jmp 0x62c11f7f
mov dword [esi + 0x14], 3
xor eax, eax
jmp 0x62c11f83
mov eax, 0x8005
or dword [esi + 0x10], 0xffffffff
and dword [esi + 0x14], 0
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.62c124d5
leave
ret 4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x588815
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x40a936
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], 0x407e80
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x34], esi
push 1
call sub.MSVBVM60.DLL___vbaOnError
mov edx, 0x4677f0
lea ecx, [ebp - 0x20]
call sub.MSVBVM60.DLL___vbaStrCopy
cmp dword [0x6255b0], esi
jne 0x58887a
push 0x6255b0
push 0x450848
call sub.MSVBVM60.DLL___vbaNew2
mov esi, dword [0x6255b0]
mov ebx, 0x80020004
mov dword [ebp - 0x2c], ebx
push 0xa
pop edi
mov dword [ebp - 0x34], edi
lea ecx, [ebp - 0x34]
call sub.MSVBVM60.DLL___vbaFreeVarg
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
push ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
push ecx
push dword [ebp - 0x20]
push esi
call dword [eax + 0x40]
fnclex
test eax, eax
jge 0x5888bd
push 0x40
push 0x4517d0
push esi
push eax
call sub.MSVBVM60.DLL___vbaHresultCheckObj
lea ecx, [ebp - 0x24]
call sub.MSVBVM60.DLL___vbaFreeObj
lea ecx, [ebp - 0x34]
call sub.MSVBVM60.DLL___vbaFreeVar
mov edx, 0x4679e8
lea ecx, [ebp - 0x20]
call sub.MSVBVM60.DLL___vbaStrCopy
cmp dword [0x6255b0], 0
jne 0x5888f2
push 0x6255b0
push 0x450848
call sub.MSVBVM60.DLL___vbaNew2
mov esi, dword [0x6255b0]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], edi
lea ecx, [ebp - 0x34]
call sub.MSVBVM60.DLL___vbaFreeVarg
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
push ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
push ecx
push dword [ebp - 0x20]
push esi
call dword [eax + 0x40]
fnclex
test eax, eax
jge 0x58892d
push 0x40
push 0x4517d0
push esi
push eax
call sub.MSVBVM60.DLL___vbaHresultCheckObj
lea ecx, [ebp - 0x24]
call sub.MSVBVM60.DLL___vbaFreeObj
lea ecx, [ebp - 0x34]
call sub.MSVBVM60.DLL___vbaFreeVar
jmp 0x58893f
call sub.MSVBVM60.DLL___vbaExitProc
push 0x588965
jmp 0x58895c
lea ecx, [ebp - 0x20]
call sub.MSVBVM60.DLL___vbaFreeStr
ret
Function at 0x403ac0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, ecx
not eax
mov edi, 4
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x431800]
sub edi, 1
jne 0x403ad2
pop edi
not eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403b00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x403b4c
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x403b2f
cmp edi, 2
jb 0x403b2f
cmp byte [esi], cl
jne 0x403b2f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x431800]
test edi, edi
jne 0x403b15
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x403b7b
cmp cl, 0x23
jne 0x403b62
cmp byte [esi], cl
jne 0x403b62
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x431800]
test cl, cl
jne 0x403b53
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x403cc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edx
push dword [ebp + 0x10]
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
xor edx, edx
pop ebp
ret

Function at 0x403ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edx
push dword [ebp + 0x10]
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor edx, edx
pop ebp
ret
Function at 0x4181a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00413870
Function at 0x41f100
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x5e6ea9af
push esi
mov esi, edx
mov ecx, 1
mul ebx
push edi
shr edx, 0xb
xor edi, edi
imul eax, edx, 0x15b0
mov edx, ebx
mov dword [ebp - 0x10], edi
sub edx, eax
mov dword [ebp - 4], edx
test ebx, ebx
je 0x41f23a
xor ebx, ebx
cmp edx, 7
jbe 0x41f199
mov eax, 7
sub eax, esi
mov dword [ebp - 0x10], eax
movzx eax, byte [esi]
add ebx, 8
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add edi, ecx
add esi, 8
add ecx, eax
mov eax, dword [ebp - 0x10]
add eax, esi
add edi, ecx
cmp eax, edx
jb 0x41f148
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
cmp ebx, eax
jae 0x41f1ff
sub eax, ebx
cmp eax, 2
jb 0x41f1eb
mov edx, dword [ebp - 4]
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea ebx, [ebx + edx*2]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 8]
mov edi, ebx
movzx eax, byte [esi]
add ecx, eax
movzx eax, byte [esi + 1]
add ebx, ecx
add esi, 2
add ecx, eax
add edi, ecx
sub edx, 1
jne 0x41f1c5
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
cmp ebx, dword [ebp - 4]
jae 0x41f1f8
movzx eax, byte [esi]
add ecx, eax
add edi, ecx
inc esi
mov eax, dword [ebp - 0xc]
add eax, edx
add edi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, dword [ebp - 4]
add edi, eax
sub dword [ebp + 8], edx
mov edx, 0x15b0
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edx
jne 0x41f137
shl edi, 0x10
lea eax, [ecx + edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420d10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x43a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.00405df0
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x20]
push eax
push dword [0x43a7a8]
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
movd xmm2, ecx
lea ecx, [ebp - 0x28]
movd xmm1, eax
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm1, xmm1
call fcn.00401580
xorps xmm0, xmm0
mov ecx, dword [eax]
mov dword [edi + 8], ecx
mov eax, dword [eax + 4]
mov dword [edi + 0xc], eax
lea eax, [ebp - 0x10]
push eax
movlpd qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [0x43a7a0]
mov edx, dword [ebp - 0xc]
sbb edx, dword [0x43a7a4]
call fcn.0042fec0
mov edx, dword [0x43a79c]
mov ecx, dword [0x43a798]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x24], xmm0
call fcn.0042fec0
movss xmm1, dword [ebp - 0x24]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0x10], xmm1
mov eax, dword [ebp - 0x10]
mov dword [0x43a7a0], eax
mov eax, dword [ebp - 0xc]
mov dword [0x43a7a4], eax
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xf4], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xf5], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xf7], 0
mov byte [edi + 0xf6], al
call fcn.00420950
cmp byte [edi + 0xa8], 0
je 0x420e1f
or eax, 0xffffffff
jmp 0x420e24
call fcn.004084e0
cmp dword [0x43a024], eax
je 0x420e36
mov dword [0x43a024], eax
call fcn.00420820
call fcn.00420a50
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042ea9e
mov esp, ebp
pop ebp
ret
Function at 0x429210
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43033b
mov eax, dword fs:[0]
push eax
sub esp, 0x1e4
mov eax, dword [0x43a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1d4], ebx
xor edi, edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4292bb
lea eax, [ebp - 0x1d0]
mov dword [ebp - 0x1d0], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4292bb
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
nop word [eax + eax]
mov ecx, 0x43a9f0
call fcn.004213c0
push eax
lea eax, [ebp - 0x1ac]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x4292af
lea eax, [ebp - 0x1d0]
push eax
push esi
call ebx
test eax, eax
jne 0x429280
jmp 0x4292b5
mov edi, dword [ebp - 0x1c8]
mov ebx, dword [ebp - 0x1d4]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
lea ecx, [ebp - 0xa8]
call fcn.004293a0
sub esp, 8
lea ecx, [ebp - 0xa8]
call fcn.0042bb80
push edi
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
test edi, edi
jne 0x42931f
push 0x10
push str.WARNING
push str.Run_the_application_first_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x435744
mov ecx, 0x43a9d8
call fcn.0042ad10
mov byte [0x43a7fd], 0
jmp 0x429354
lea eax, [ebp - 0x1ec]
mov dword [0x43aab8], edi
push eax
lea ecx, [ebp - 0xa8]
call fcn.0042bb30
push eax
mov ecx, 0x43a9d8
call fcn.0042ad50
lea ecx, [ebp - 0x1ec]
call fcn.0042ad40
mov byte [0x43a7fd], 1
lea ecx, [ebp - 0xa8]
call fcn.00429380
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042ea9e
mov esp, ebp
pop ebp
ret