joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407588
Capabilities:
Get number of processors

Disassembly:
mov edx, dword [ebp - 0x500]
add edx, 1
mov dword [ebp - 0x500], edx
push edi
push edx
add esp, 4
jmp 0x4074db
xor edi, 0x12b0b
add edi, 0xc5a1
pop edi
push esi
sub esi, 0x9c7a
xor esi, 0x1522d
sub esi, 0xf5a3
add esi, 0x12d86
pop esi
mov eax, dword [ebp - 0x500]
sub eax, dword [ebp - 0x3f0]
cmp eax, 0xffffffff
jb 0x40754a
push edi
call 0x407524
add byte [ecx + 0x40], cl
inc eax
aas
dec esi
xor al, 0x47
inc edi
inc eax
xor al, 0x83
les eax, [edi + ebx*2]
push edi
push eax
add esp, 4
or edi, 0x11e48
add edi, 0x16041
add edi, 0x123cc
jmp 0x407544
pop edi
jmp 0x407778
mov dword [ebp - 0xc88], 7
mov ecx, dword [ebp - 0x500]
mov dword [ebp - 0xac0], ecx
push edx
push edi
add esp, 4
add edx, 0x6fb2
add edx, 0xa053
pop edx
push edi
add edi, 0x13e3a
or edi, 0x145b
add edi, 0x127f5
pop edi
push ecx
push eax
add esp, 4
or ecx, 0x1340a
pop ecx
mov edx, dword [ebp - 0x15d0]
mov dword [ebp - 0xabc], edx
mov dword [ebp - 0xc8c], 0
mov eax, dword [ebp - 0x500]
cmp eax, dword [ebp - 0x15d0]
jne 0x4075f9
push eax
push eax
add esp, 4
or eax, 0x86e0
or eax, 0xbb60
pop eax
push edx
push edi
add esp, 4
jmp 0x4075d2
or edx, 0x12c57
pop edx
push edi
push ecx
add esp, 4
jmp 0x4075e7
pop edi
mov ecx, dword [ebp - 0xc8c]
mov dword [ebp - 0x15d4], ecx
jmp 0x40772a
cmp dword [ebp - 0xc88], 0
jle 0x40771e
push ecx
push esi
add esp, 4
jmp 0x407610
and ecx, 0x11cc6
pop ecx
push edi
push edi
add esp, 4
xor edi, 0xb937
xor edi, 0xe85c
call 0x407634
add byte [edx + ecx*2], bh
cmp dword [0xc4834134], esi
add al, 0x5f
mov edx, dword [ebp - 0xac0]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xabc]
movzx edx, byte [ecx]
cmp eax, edx
je 0x4076ba
push edi
push eax
add esp, 4
add edi, 0x11ad1
add edi, 0x1856d
xor edi, 0x1091e
and edi, 0x2dc6
pop edi
push edx
jmp 0x407673
sub edx, 0x76a
add edx, 0x7ebc
pop edx
mov eax, dword [ebp - 0xac0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xabc]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x4076a2
mov dword [ebp - 0x15a0], 1
jmp 0x4076ac
mov dword [ebp - 0x15a0], 0xffffffff
mov ecx, dword [ebp - 0x15a0]
mov dword [ebp - 0xc8c], ecx
jmp 0x40771e
push esi
push edx
add esp, 4
jmp 0x4076c5
pop esi
push ecx
jmp 0x4076cf
pop ecx
push esi
add esi, 0x158fb
or esi, 0xa87a
or esi, 0xdb2e
jmp 0x4076eb
pop esi
mov edx, dword [ebp - 0xc88]
sub edx, 1
mov dword [ebp - 0xc88], edx
mov eax, dword [ebp - 0xac0]
add eax, 1
mov dword [ebp - 0xac0], eax
mov ecx, dword [ebp - 0xabc]
add ecx, 1
mov dword [ebp - 0xabc], ecx
jmp 0x4075f9
mov edx, dword [ebp - 0xc8c]
mov dword [ebp - 0x15d4], edx
cmp dword [ebp - 0x15d4], 0
jne 0x407773
push eax
push esi
add esp, 4
add eax, 0x151f5
sub eax, 0xe14
and eax, 0x15194
jmp fcn.00407750
jmp 0x4074c1
push eax
push ecx
add esp, 4
jmp 0x407785
add eax, 0x7772
add eax, 0x13bc1
pop eax
push ebx
push edi
add esp, 4
jmp 0x40779d
pop ebx
push edx
push esi
add esp, 4
sub edx, 0x66af
pop edx
mov dword [ebp - 0xab8], 0
Function at 0x407634
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov edx, dword [ebp - 0x500]
add edx, 1
mov dword [ebp - 0x500], edx
push edi
push edx
add esp, 4
jmp 0x4074db
xor edi, 0x12b0b
add edi, 0xc5a1
pop edi
push esi
sub esi, 0x9c7a
xor esi, 0x1522d
sub esi, 0xf5a3
add esi, 0x12d86
pop esi
mov eax, dword [ebp - 0x500]
sub eax, dword [ebp - 0x3f0]
cmp eax, 0xffffffff
jb 0x40754a
push edi
call 0x407524
add byte [ecx + 0x40], cl
inc eax
aas
dec esi
xor al, 0x47
inc edi
inc eax
xor al, 0x83
les eax, [edi + ebx*2]
push edi
push eax
add esp, 4
or edi, 0x11e48
add edi, 0x16041
add edi, 0x123cc
jmp 0x407544
pop edi
jmp 0x407778
mov dword [ebp - 0xc88], 7
mov ecx, dword [ebp - 0x500]
mov dword [ebp - 0xac0], ecx
push edx
push edi
add esp, 4
add edx, 0x6fb2
add edx, 0xa053
pop edx
push edi
add edi, 0x13e3a
or edi, 0x145b
add edi, 0x127f5
pop edi
push ecx
push eax
add esp, 4
or ecx, 0x1340a
pop ecx
mov edx, dword [ebp - 0x15d0]
mov dword [ebp - 0xabc], edx
mov dword [ebp - 0xc8c], 0
mov eax, dword [ebp - 0x500]
cmp eax, dword [ebp - 0x15d0]
jne 0x4075f9
push eax
push eax
add esp, 4
or eax, 0x86e0
or eax, 0xbb60
pop eax
push edx
push edi
add esp, 4
jmp 0x4075d2
or edx, 0x12c57
pop edx
push edi
push ecx
add esp, 4
jmp 0x4075e7
pop edi
mov ecx, dword [ebp - 0xc8c]
mov dword [ebp - 0x15d4], ecx
jmp 0x40772a
cmp dword [ebp - 0xc88], 0
jle 0x40771e
push ecx
push esi
add esp, 4
jmp 0x407610
and ecx, 0x11cc6
pop ecx
push edi
push edi
add esp, 4
xor edi, 0xb937
xor edi, 0xe85c
call 0x407634
add byte [edx + ecx*2], bh
cmp dword [0xc4834134], esi
add al, 0x5f
mov edx, dword [ebp - 0xac0]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xabc]
movzx edx, byte [ecx]
cmp eax, edx
je 0x4076ba
push edi
push eax
add esp, 4
add edi, 0x11ad1
add edi, 0x1856d
xor edi, 0x1091e
and edi, 0x2dc6
pop edi
push edx
jmp 0x407673
sub edx, 0x76a
add edx, 0x7ebc
pop edx
mov eax, dword [ebp - 0xac0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xabc]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x4076a2
mov dword [ebp - 0x15a0], 1
jmp 0x4076ac
mov dword [ebp - 0x15a0], 0xffffffff
mov ecx, dword [ebp - 0x15a0]
mov dword [ebp - 0xc8c], ecx
jmp 0x40771e
push esi
push edx
add esp, 4
jmp 0x4076c5
pop esi
push ecx
jmp 0x4076cf
pop ecx
push esi
add esi, 0x158fb
or esi, 0xa87a
or esi, 0xdb2e
jmp 0x4076eb
pop esi
mov edx, dword [ebp - 0xc88]
sub edx, 1
mov dword [ebp - 0xc88], edx
mov eax, dword [ebp - 0xac0]
add eax, 1
mov dword [ebp - 0xac0], eax
mov ecx, dword [ebp - 0xabc]
add ecx, 1
mov dword [ebp - 0xabc], ecx
jmp 0x4075f9
mov edx, dword [ebp - 0xc8c]
mov dword [ebp - 0x15d4], edx
cmp dword [ebp - 0x15d4], 0
jne 0x407773
push eax
push esi
add esp, 4
add eax, 0x151f5
sub eax, 0xe14
and eax, 0x15194
jmp fcn.00407750
jmp 0x4074c1
push eax
push ecx
add esp, 4
jmp 0x407785
add eax, 0x7772
add eax, 0x13bc1
pop eax
push ebx
push edi
add esp, 4
jmp 0x40779d
pop ebx
push edx
push esi
add esp, 4
sub edx, 0x66af
pop edx
mov dword [ebp - 0xab8], 0
Function at 0x407d9d
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
sub edx, 0xf9ed
and edx, 0x16c02
pop edx
push ebx
push esi
add esp, 4
jmp 0x407c14
pop ebx
push esi
push edi
add esp, 4
and esi, 0x13f8e
pop esi
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x31c], eax
jmp 0x407c97
push edx
call 0x407ca8
add byte [esi + 0x41], cl
dec ebx
cmp al, byte ss:[edx + 0x41]
cmp byte [esi], dh
aas
add esp, 4
sub edx, 0x3a6b
and edx, 0x114e4
call 0x407cc5
add byte [esi], dh
dec esp
aas
dec ebx
cmp eax, dword ss:[ebp + 0x3e]
add esp, 4
pop edx
cmp dword [ebp - 0x31c], 0
jne 0x4085e2
mov edx, 0x6b
mov word [ebp - 0x1774], dx
mov eax, 0x65
mov word [ebp - 0x1772], ax
mov ecx, 0x72
mov word [ebp - 0x1770], cx
mov edx, 0x6e
mov word [ebp - 0x176e], dx
mov eax, 0x65
mov word [ebp - 0x176c], ax
mov ecx, 0x6c
mov word [ebp - 0x176a], cx
mov edx, 0x33
mov word [ebp - 0x1768], dx
mov eax, 0x32
mov word [ebp - 0x1766], ax
mov ecx, 0x2e
mov word [ebp - 0x1764], cx
mov edx, 0x64
mov word [ebp - 0x1762], dx
mov eax, 0x6c
mov word [ebp - 0x1760], ax
mov ecx, 0x6c
mov word [ebp - 0x175e], cx
xor edx, edx
mov word [ebp - 0x175c], dx
push edi
push ecx
add esp, 4
and edi, 0xa2ab
add edi, 0x2d99
call 0x407d8c
add byte [ecx + 0x4e], cl
cmp eax, 0x83424b45
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [ecx + 0x48], cl
dec ebx
cmp dh, byte [0x83384642]
les eax, [edi + ebx*2]
mov byte [ebp - 0x894], 0x4c
mov byte [ebp - 0x893], 0x6f
mov byte [ebp - 0x892], 0x61
mov byte [ebp - 0x891], 0x64
mov byte [ebp - 0x890], 0x4c
mov byte [ebp - 0x88f], 0x69
mov byte [ebp - 0x88e], 0x62
mov byte [ebp - 0x88d], 0x72
mov byte [ebp - 0x88c], 0x61
mov byte [ebp - 0x88b], 0x72
mov byte [ebp - 0x88a], 0x79
mov byte [ebp - 0x889], 0x57
mov byte [ebp - 0x888], 0
mov eax, dword fs:[0x18]
add byte [eax], al
mov dword [ebp - 0x195c], eax
mov ecx, dword [ebp - 0x195c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1960], edx
mov eax, dword [ebp - 0x1960]
mov dword [ebp - 0x15e4], eax
push edi
push edx
add esp, 4
add edi, 0x14699
xor edi, 0x9c9d
sub edi, 0x10e2a
pop edi
push esi
push esi
add esp, 4
xor esi, 0x13ec8
pop esi
push ecx
push edx
push ebx
add esp, 4
sub edx, 0x69e1
add byte [edx + 0x52], bl
jmp 0x4085f4
jmp 0x4085fc
sub edx, 0x64a6
pop edx
push edi
call 0x408610
add byte [edi + 0x4d], al
cmp ecx, dword [ebp + ecx*2 + 0x34]
add esp, 4
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x197c], eax
mov ecx, dword [ebp - 0x197c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1980], edx
mov eax, dword [ebp - 0x1980]
mov dword [ebp - 0x15fc], eax
push ecx
call 0x408649
add byte [esi + eax*2 + 0x37], cl
inc ecx
xor bh, byte [esi]
dec esi
add esp, 4
pop ecx
push ecx
push ecx
add esp, 4
add ecx, 0x465d
Function at 0x408192
Capabilities:
Get number of processors

Disassembly:
and edi, ebx
add byte [eax], al
and ebx, 0x13466
pop ebx
push ecx
add ecx, 0x9fdd
add ecx, 0x36a6
add ecx, 0x5d07
pop ecx
push esi
push edx
add esp, 4
sub esi, 0x759
pop esi
cmp dword [ebp - 0x750], 0
jne 0x4081a5
push edx
push ebx
add esp, 4
sub edx, 0xc6ef
call 0x40817c
or byte [eax], al
add byte [eax], al
add byte [edx + 0x35], al
dec esp
dec ebx
cmp eax, 0xc4835043
add al, 0x5a
push ecx
push ecx
add esp, 4
add al, 0xe8
or byte [eax], al
add byte [eax], al
add byte [ebx], dh
cmp dword [ecx + 0x47], ecx
dec eax
cmp bh, byte [0x5904c483]
mov dword [ebp - 0x79c], 0
jmp 0x408ccc
push ecx
push eax
add esp, 4
and ecx, 0x7f9d
pop ecx
push ebx
push ecx
add esp, 4
call 0x4081c4
add byte [edi + 0x42], cl
dec edx
cmp dword [edx], esi
xor bh, byte [edx + edi]
push eax
add esp, 4
jmp 0x4081d0
or ebx, 0x1650
pop ebx
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
jne 0x408216
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x408507
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x15f4], edx
jne 0x40823e
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x408507
invalid
invalid

Function at 0x4081c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and edi, ebx
add byte [eax], al
and ebx, 0x13466
pop ebx
push ecx
add ecx, 0x9fdd
add ecx, 0x36a6
add ecx, 0x5d07
pop ecx
push esi
push edx
add esp, 4
sub esi, 0x759
pop esi
cmp dword [ebp - 0x750], 0
jne 0x4081a5
push edx
push ebx
add esp, 4
sub edx, 0xc6ef
call 0x40817c
or byte [eax], al
add byte [eax], al
add byte [edx + 0x35], al
dec esp
dec ebx
cmp eax, 0xc4835043
add al, 0x5a
push ecx
push ecx
add esp, 4
add al, 0xe8
or byte [eax], al
add byte [eax], al
add byte [ebx], dh
cmp dword [ecx + 0x47], ecx
dec eax
cmp bh, byte [0x5904c483]
mov dword [ebp - 0x79c], 0
jmp 0x408ccc
push ecx
push eax
add esp, 4
and ecx, 0x7f9d
pop ecx
push ebx
push ecx
add esp, 4
call 0x4081c4
add byte [edi + 0x42], cl
dec edx
cmp dword [edx], esi
xor bh, byte [edx + edi]
push eax
add esp, 4
jmp 0x4081d0
or ebx, 0x1650
pop ebx
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
jne 0x408216
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x408507
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x15f4], edx
jne 0x40823e
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x408507
invalid
invalid
Function at 0x4081c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and edi, ebx
add byte [eax], al
and ebx, 0x13466
pop ebx
push ecx
add ecx, 0x9fdd
add ecx, 0x36a6
add ecx, 0x5d07
pop ecx
push esi
push edx
add esp, 4
sub esi, 0x759
pop esi
cmp dword [ebp - 0x750], 0
jne 0x4081a5
push edx
push ebx
add esp, 4
sub edx, 0xc6ef
call 0x40817c
or byte [eax], al
add byte [eax], al
add byte [edx + 0x35], al
dec esp
dec ebx
cmp eax, 0xc4835043
add al, 0x5a
push ecx
push ecx
add esp, 4
add al, 0xe8
or byte [eax], al
add byte [eax], al
add byte [ebx], dh
cmp dword [ecx + 0x47], ecx
dec eax
cmp bh, byte [0x5904c483]
mov dword [ebp - 0x79c], 0
jmp 0x408ccc
push ecx
push eax
add esp, 4
and ecx, 0x7f9d
pop ecx
push ebx
push ecx
add esp, 4
call 0x4081c4
add byte [edi + 0x42], cl
dec edx
cmp dword [edx], esi
xor bh, byte [edx + edi]
push eax
add esp, 4
jmp 0x4081d0
or ebx, 0x1650
pop ebx
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
jne 0x408216
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x408507
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x15f4], edx
jne 0x40823e
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x408507
invalid
invalid

Function at 0x4085c7
Capabilities:
Get number of processors

Disassembly:
dec dword [ecx - 0x3f36b]
inc dword [ebx - 0x3f343]
inc dword [eax]
je 0x4085e2
push esi
push ebx
add esp, 4
add esi, 0x1153
xor esi, 0x80e
xor esi, 0x24e
pop esi
push ecx
and ecx, 0x6f24
sub ecx, 0x462b
add ecx, 0x457b
add ecx, 0xedbe
pop ecx
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x1974], eax
invalid
call dword [ecx + 0x53]
add esp, 4
call 0x408563
add byte [esi + 0x4f], cl
xor al, 0x35
inc ebp
dec esp
add esp, 4
pop ecx
push edx
push ecx
add esp, 4
add edx, 0x1ae6
xor edx, 0xa02
pop edx
push eax
jmp 0x408583
pop eax
mov ecx, dword [ebp - 0x1974]
mov dword [ebp - 0x1978], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x1978]
test eax, eax
jne 0x4085e2
push edx
push edx
add esp, 4
xor edx, 0x13713
adc esi, dword [edi]
add dword [eax], eax
xor edx, 0x17d48
pop edx
push esi
push eax
add esp, 4
call 0x4085c7
add byte [edx + 0x45], cl
dec eax
xor al, 0x36
cmp eax, 0x83463247
Function at 0x4085c8
Capabilities:
Get number of processors

Disassembly:
les eax, [esi + ebx*2]
push eax
add eax, 0xbef5
pop eax
mov dword [ebp - 0x79c], 0
add cl, ch
invalid
push es
add byte [eax], al
push esi
push edi
add esp, 4
add esi, 0x11156
xor esi, 0xca70
pop esi
push ebx
xor ebx, 0x4eeb
sub ebx, 0x79c4
jmp 0x408cf4
jmp 0x408cfd
pop ebx
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xe
mov dword [ebp - 0x19dc], ecx
lea esp, [esi]
invalid
call dword [edi - 0x7f]
not dword [ecx]
stosd dword es:[edi], eax
add byte [eax], al
pop edi
push eax
push eax
add esp, 4
xor eax, 0x691c
and eax, 0xe8aa
pop eax
push eax
jmp 0x408d30
xor eax, 0x16872
pop eax
push eax
xor eax, 0x965c
pop eax
cmp dword [ebp - 0x3e8], 0
je 0x408d51
cmp dword [ebp - 0xab8], 0
jne 0x408d97
push esi
push edi
add esp, 4
add esi, 0xbc46
call 0x408d6b
add byte [0x344b3f39], bh
aaa
dec esi
cmp byte ss:[ebx - 0x397efb3c], al
movsd dword es:[edi], dword [esi]
pop esp
add dword [eax], eax
xor esi, 0xd26a
pop esi
push edx
and edx, 0x1c61
pop edx
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1990], edx
push 0
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push eax
or eax, 0x9cbc
add eax, 0x3e7b
and eax, 0xcb8f
or eax, 0xe9b
pop eax
push edx
push eax
add esp, 4
xor edx, 0x16c42
sub edx, 0x10b6e
sub edx, 0x12da9
pop edx
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push edi
and edi, 0x110c9
add edi, 0x28f2
pop edi
push eax
push ecx
add esp, 4
and eax, 0x10576
xor eax, 0x9d0a
pop eax
push ecx
push edi
add esp, 4
invalid
Function at 0x408d6b
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
les eax, [esi + ebx*2]
push eax
add eax, 0xbef5
pop eax
mov dword [ebp - 0x79c], 0
add cl, ch
invalid
push es
add byte [eax], al
push esi
push edi
add esp, 4
add esi, 0x11156
xor esi, 0xca70
pop esi
push ebx
xor ebx, 0x4eeb
sub ebx, 0x79c4
jmp 0x408cf4
jmp 0x408cfd
pop ebx
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xe
mov dword [ebp - 0x19dc], ecx
lea esp, [esi]
invalid
call dword [edi - 0x7f]
not dword [ecx]
stosd dword es:[edi], eax
add byte [eax], al
pop edi
push eax
push eax
add esp, 4
xor eax, 0x691c
and eax, 0xe8aa
pop eax
push eax
jmp 0x408d30
xor eax, 0x16872
pop eax
push eax
xor eax, 0x965c
pop eax
cmp dword [ebp - 0x3e8], 0
je 0x408d51
cmp dword [ebp - 0xab8], 0
jne 0x408d97
push esi
push edi
add esp, 4
add esi, 0xbc46
call 0x408d6b
add byte [0x344b3f39], bh
aaa
dec esi
cmp byte ss:[ebx - 0x397efb3c], al
movsd dword es:[edi], dword [esi]
pop esp
add dword [eax], eax
xor esi, 0xd26a
pop esi
push edx
and edx, 0x1c61
pop edx
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1990], edx
push 0
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push eax
or eax, 0x9cbc
add eax, 0x3e7b
and eax, 0xcb8f
or eax, 0xe9b
pop eax
push edx
push eax
add esp, 4
xor edx, 0x16c42
sub edx, 0x10b6e
sub edx, 0x12da9
pop edx
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push edi
and edi, 0x110c9
add edi, 0x28f2
pop edi
push eax
push ecx
add esp, 4
and eax, 0x10576
xor eax, 0x9d0a
pop eax
push ecx
push edi
add esp, 4
invalid
Function at 0x409d33
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x409d33
add byte [eax + 0x38], dl
inc ebp
xor al, 0x41
cmp al, byte [esi + 0x49]
add esp, 4
sub eax, 0x47ab
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x409d5a
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp fcn.00409db4
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
invalid

Function at 0x409da4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [eax], eax
add byte [eax], al
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx

Function at 0x409dcb
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push edx
xor edx, 0x118d1
or edx, 0x16379
arpl word [ecx], ax
add bl, ch
invalid
pop edx
push edi
push esi
add esp, 4
add edi, 0x12dd7
call 0x409c54
add byte [edi], bh
dec esi
aaa
inc eax
inc ecx
inc esp
inc edi
xor eax, 0x4c4834e
pop edi
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push eax
push eax
add esp, 4
xor eax, 0x43e0
xor eax, 0x7717
pop eax
push ecx
push eax
add esp, 4
xor ecx, 0x110f3
or ecx, 0x4a09
add ecx, 0x16d7
pop ecx
push ebx
add ebx, 0xf249
pop ebx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push edx
sub edx, 0x152a0
xor edx, 0x11bdc
pop edx
push eax
push esi
add esp, 4
sub eax, 0xebcf
cmp dword [ebp - 0x1684], 0
jne 0x409dfd
push eax
call 0x409dcb
add byte [eax + edx*2], dh
inc esp
xor eax, dword [edx + 0x4f]
dec edi
add esp, 4
xor eax, 0x12fa4
pop eax
push edi
push edx
add esp, 4
and edi, 0x1747f
pop edi
push ebx
jmp 0x409de8
sub ebx, 0x173c8
pop ebx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x409e65
push ecx
push edx
add esp, 4
add ecx, 0x1023
or ecx, 0x17361
pop ecx
push eax
push esi
add esp, 4
and eax, 0xfcc5
and eax, 0x12f78
pop eax
push edi
push edx
add esp, 4
jmp 0x409e2e
pop edi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x409e5b
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x409c26
mov dword [ebp - 0x2fc], 0
push eax
push ebx
add esp, 4
add eax, 0xf02
xor eax, 0x105f5
pop eax
push edi
push esi
add esp, 4
xor edi, 0x84f2
and edi, 0x56f4
xor edi, 0x5b02
pop edi
push ecx
add ecx, 0xefa9
pop ecx
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push eax
push ecx
add esp, 4
sub eax, 0x6ec8
and eax, 0x1499f
pop eax
Function at 0x42fe28
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00405228
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x42fe76
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00405498
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x438c10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x47ac4c], 0
je 0x438d59
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x475330]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x438d59
mov eax, dword [0x47ac50]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x47ac4c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x438d28
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x47ac4c]
call fcn.004185bc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x438d20
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x438d20
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x438d20
mov eax, dword [ebp - 0x14]
call fcn.004431bc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x438d20
push ebp
call fcn.00438bcc
pop ecx
test al, al
jne 0x438d20
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.004045f8
test al, al
je 0x438d20
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.004045f8
cmp byte [ebp - 1], 0
je 0x438d20
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x438d20
mov edx, dword [ebp - 0x14]
mov eax, dword [0x47ac50]
call fcn.0043833c
inc edi
dec ebx
jne 0x438c75
mov eax, dword [0x47ac50]
cmp dword [eax + 8], 0
jle 0x438d40
mov eax, dword [0x47ac50]
call fcn.004383f4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x438d59
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00438a30
pop ecx
test al, al
jne 0x438d59
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret