joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d5a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor edx, edx
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], edx
dec eax
cmp eax, 0x29
jl 0x42d716
mov ecx, eax
sub ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jge 0x42d5d7
mov dword [ebp - 0xc], 1
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 8]
add ecx, 0x14
mov dword [ebp - 4], ecx
lea ebx, [eax - 0x14]
push 0x7a
push 0x49c90c
push ebx
call fcn.00410d04
add esp, 0xc
mov esi, eax
test esi, esi
jne 0x42d619
push 0x7d
push 0x49c924
push 0x41
push 0x7a
push 4
call fcn.0043a9b8
add esp, 0x14
or eax, 0xffffffff
jmp 0x42d73c
push ebx
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 4]
push edx
push 0x14
push ecx
call fcn.0042d838
add esp, 0x10
mov eax, dword [ebp - 8]
lea edx, [ebp + eax - 0x24]
cmp eax, 0x14
jge 0x42d64c
mov ecx, eax
mov edi, dword [ebp + 0x10]
sub ecx, dword [ebp - 8]
inc eax
mov cl, byte [edi + ecx]
xor byte [edx], cl
inc edx
cmp eax, 0x14
jl 0x42d638
push 0x14
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
call fcn.0042d838
mov edx, esi
add esp, 0x10
mov dword [ebp - 0x10], edx
xor eax, eax
mov ecx, dword [ebp - 4]
cmp ebx, eax
mov edx, ecx
jle 0x42d67c
mov cl, byte [edx]
mov edi, dword [ebp - 0x10]
xor byte [edi], cl
inc eax
inc dword [ebp - 0x10]
inc edx
cmp ebx, eax
jg 0x42d66c
push 0
call fcn.0043c868
push eax
lea eax, [ebp - 0x38]
push 0
push eax
mov edx, dword [ebp + 0x20]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.0043c718
add esp, 0x18
lea eax, [ebp - 0x38]
push 0x14
push eax
push esi
call fcn.00406070
add esp, 0xc
test eax, eax
jne 0x42d716
cmp dword [ebp - 0xc], 0
jne 0x42d716
mov eax, 0x14
lea edx, [esi + 0x14]
cmp ebx, eax
jle 0x42d6ca
cmp byte [edx], 0
jne 0x42d6ca
inc eax
inc edx
cmp ebx, eax
jg 0x42d6bf
cmp byte [esi + eax], 1
jne 0x42d716
mov ecx, eax
inc eax
cmp ebx, ecx
jle 0x42d716
sub ebx, eax
cmp ebx, dword [ebp + 0xc]
jle 0x42d6fb
push 0x9b
push 0x49c93c
push 0x6d
push 0x7a
push 4
call fcn.0043a9b8
add esp, 0x14
or ebx, 0xffffffff
jmp 0x42d70b
push ebx
add eax, esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00405db4
add esp, 0xc
push esi
call fcn.00410ec4
pop ecx
mov eax, ebx
jmp 0x42d73c
push 0xa8
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call fcn.0043a9b8
add esp, 0x14
test esi, esi
je 0x42d739
push esi
call fcn.00410ec4
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d8d8
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
cmp edx, dword [ebp + 0x18]
jne 0x42d8f3
mov cl, byte [eax]
cmp cl, 0x6a
je 0x42d914
cmp cl, 0x6b
je 0x42d914
push 0x72
push 0x49c984
push 0x89
push 0x80
push 4
call fcn.0043a9b8
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
mov cl, byte [eax]
inc eax
cmp cl, 0x6b
jne 0x42d985
lea esi, [edx - 3]
xor ecx, ecx
cmp esi, ecx
jle 0x42d95b
mov dl, byte [eax]
inc eax
cmp dl, 0xba
je 0x42d95b
cmp dl, 0xbb
je 0x42d956
push 0x81
push 0x49c99c
push 0x8a
push 0x80
push 4
call fcn.0043a9b8
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
inc ecx
cmp esi, ecx
jg 0x42d925
sub esi, ecx
test ecx, ecx
jne 0x42d988
push 0x8a
push 0x49c9b4
push 0x8a
push 0x80
push 4
call fcn.0043a9b8
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
lea esi, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x42d9b2
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.0043a9b8
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
push esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00405db4
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
Function at 0x43a10d
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov ebx, 0x10
call sub.KERNEL32.DLL_GetVersion
cmp eax, 0x80000000
jae 0x43a23f
call fcn.00410670
test eax, eax
je 0x43a23f
push 0
push 0
push 0
push str.DISPLAY
call sub.GDI32.DLL_CreateDCA
mov esi, eax
push esi
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [esp], eax
push 8
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [esp + 0x10], eax
push 0xa
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [esp + 0x14], eax
push ebx
mov eax, dword [esp + 0x14]
push eax
push esi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov edi, eax
push edi
mov eax, dword [esp + 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [esp + 4], eax
lea edx, [esp + 0x18]
push edx
push 0x18
push edi
call sub.GDI32.DLL_GetObjectA
mov ecx, dword [esp + 0x24]
imul ecx, dword [esp + 0x20]
movzx eax, word [esp + 0x28]
imul ecx, eax
mov dword [esp + 8], ecx
push 0x2d5
push str..crypto_rand_rand_win.c
mov edx, dword [esp + 0x10]
push edx
call fcn.00410d04
add esp, 0xc
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x43a219
xor ebp, ebp
jmp 0x43a204
push 0xcc0020
push ebp
push 0
push esi
push ebx
mov eax, dword [esp + 0x24]
push eax
push 0
push 0
mov edx, dword [esp + 0x20]
push edx
call sub.GDI32.DLL_BitBlt
mov ecx, dword [esp + 0xc]
push ecx
mov eax, dword [esp + 0xc]
push eax
push edi
call sub.GDI32.DLL_GetBitmapBits
push 0
call fcn.0043c868
push eax
push 0
lea edx, [esp + 0x3c]
push edx
mov ecx, dword [esp + 0x18]
push ecx
mov eax, dword [esp + 0x20]
push eax
call fcn.0043c718
add esp, 0x18
push 0
push 0
push 0x14
lea edx, [esp + 0x3c]
push edx
call fcn.004397b8
add esp, 0x10
add ebp, ebx
mov ecx, dword [esp + 0x14]
sub ecx, ebx
cmp ebp, ecx
jl 0x43a1a1
mov eax, dword [esp + 0xc]
push eax
call fcn.00410ec4
pop ecx
mov edx, dword [esp + 4]
push edx
mov ecx, dword [esp + 4]
push ecx
call sub.GDI32.DLL_SelectObject
mov edi, eax
push edi
call sub.GDI32.DLL_DeleteObject
mov eax, dword [esp]
push eax
call sub.GDI32.DLL_DeleteDC
push esi
call sub.GDI32.DLL_DeleteDC
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x43d49c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x43d4b5
cmp dword [esi + 8], 0
jne 0x43d4bc
xor eax, eax
jmp 0x43d5af
mov edx, dword [esi + 4]
and edx, 0x100
mov dword [ebp - 8], edx
mov eax, dword [esi]
test eax, eax
jne 0x43d4d7
mov dword [ebp - 4], 1
jmp 0x43d534
mov dword [ebp - 4], eax
xor eax, eax
mov edx, dword [esi + 8]
cmp dword [ebp - 8], 0
mov al, byte [edx]
jne 0x43d4f5
cmp eax, 0x7f
jle 0x43d4f5
mov ebx, 1
xor ecx, ecx
jmp 0x43d531
cmp dword [ebp - 8], 0
je 0x43d531
cmp eax, 0x80
jle 0x43d50b
mov ebx, 1
mov cl, 0xff
jmp 0x43d531
cmp eax, 0x80
jne 0x43d531
mov eax, 1
mov edx, dword [esi + 8]
inc edx
jmp 0x43d52d
cmp byte [edx], 0
je 0x43d52b
mov ebx, 1
mov cl, 0xff
jmp 0x43d531
inc eax
inc edx
cmp eax, dword [esi]
jl 0x43d51d
add dword [ebp - 4], ebx
cmp dword [ebp + 0xc], 0
jne 0x43d53f
mov eax, dword [ebp - 4]
jmp 0x43d5af
mov edx, dword [ebp + 0xc]
test ebx, ebx
mov edx, dword [edx]
je 0x43d54b
mov byte [edx], cl
inc edx
cmp dword [esi], 0
jne 0x43d555
mov byte [edx], 0
jmp 0x43d5a4
cmp dword [ebp - 8], 0
jne 0x43d56d
mov eax, dword [esi]
push eax
mov ecx, dword [esi + 8]
push ecx
push edx
call fcn.00405db4
add esp, 0xc
jmp 0x43d5a4
mov eax, dword [esi]
mov ecx, dword [esi + 8]
add ecx, eax
mov ebx, eax
dec ebx
dec ecx
add edx, ebx
jmp 0x43d582
mov byte [edx], 0
dec edx
dec ecx
dec eax
cmp byte [ecx], 0
je 0x43d57c
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
inc ebx
mov byte [edx], bl
dec edx
test eax, eax
jle 0x43d5a4
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
mov byte [edx], bl
dec edx
test eax, eax
jg 0x43d596
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
add dword [eax], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x43d5b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
cmp dword [ebp + 8], 0
je 0x43d5ce
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x43d5ec
push 2
call fcn.004418e8
pop ecx
mov esi, eax
test eax, eax
jne 0x43d5e3
xor eax, eax
jmp 0x43d736
mov dword [esi + 4], 2
jmp 0x43d5f1
mov edx, dword [ebp + 8]
mov esi, dword [edx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
add eax, ebx
mov dword [ebp - 4], eax
push 0xc7
push 0x4b39c8
mov edx, dword [ebp + 0x10]
inc edx
push edx
call fcn.00410d04
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43d628
mov eax, 0x41
jmp 0x43d702
cmp dword [ebp + 0x10], 0
mov edx, dword [ebp - 8]
jne 0x43d63d
mov dword [esi + 4], 2
jmp 0x43d6d2
test byte [ebx], 0x80
je 0x43d6ab
mov dword [esi + 4], 0x102
cmp byte [ebx], 0xff
jne 0x43d658
cmp dword [ebp + 0x10], 1
je 0x43d658
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
lea ecx, [eax - 1]
add ebx, ecx
add edx, ecx
jmp 0x43d66a
mov byte [edx], 0
dec edx
dec eax
dec ebx
cmp byte [ebx], 0
jne 0x43d673
test eax, eax
jne 0x43d664
test eax, eax
jne 0x43d68c
mov edx, dword [ebp - 8]
mov byte [edx], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
mov byte [eax + edx], 0
inc dword [ebp + 0x10]
jmp 0x43d6d2
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
inc ecx
mov byte [edx], cl
dec edx
test eax, eax
jle 0x43d6d2
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
mov byte [edx], cl
dec edx
test eax, eax
jg 0x43d69b
jmp 0x43d6d2
mov dword [esi + 4], 2
cmp byte [ebx], 0
jne 0x43d6c1
cmp dword [ebp + 0x10], 1
je 0x43d6c1
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
push eax
push ebx
mov edx, dword [ebp - 8]
push edx
call fcn.00405db4
add esp, 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0x43d6e0
push eax
call fcn.00410ec4
pop ecx
mov edx, dword [ebp - 8]
mov dword [esi + 8], edx
mov ecx, dword [ebp + 0x10]
mov dword [esi], ecx
cmp dword [ebp + 8], 0
je 0x43d6f6
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, esi
jmp 0x43d736
push 0x103
push 0x4b39de
push eax
push 0xc2
push 0xd
call fcn.0043a9b8
add esp, 0x14
test esi, esi
je 0x43d734
cmp dword [ebp + 8], 0
je 0x43d72d
mov edx, dword [ebp + 8]
cmp esi, dword [edx]
je 0x43d734
push esi
call fcn.00441938
pop ecx
xor eax, eax
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4438dc
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [edx + 4]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ebx + 8]
mov dword [ebp - 0xc], esi
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, 0x20
jmp 0x44394b
add ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
add eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
add edx, esi
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x443913
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4458c8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push esi
push edi
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x445967
mov dword [ebp - 0xc], 0xc8
push str.HIDVid_3689Pid_8762
call fcn.00405fa4
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
push 0x4b5a82
call fcn.00406218
add esp, 0xc
test eax, eax
jne 0x445967
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jne 0x445964
mov ecx, dword [ebp + 0x10]
mov esi, 0x4b5aae
mov edi, ecx
lea edx, [ebp - 0x110]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00405ec8
add esp, 8
mov eax, 1
jmp 0x445972
inc dword [ebp - 0x10]
inc esi
test ebx, ebx
je 0x4458e7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x57b2de
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x57b2fb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x57b2ec
add dl, dl
jne 0x57b306
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x57b352
xor eax, eax
add dl, dl
jne 0x57b313
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x57b3ef
add dl, dl
jne 0x57b322
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x57b32d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x57b338
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x57b343
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x57b34d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x57b2f2
mov eax, 1
add dl, dl
jne 0x57b360
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x57b36b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x57b357
sub eax, 2
jne 0x57b39a
mov ecx, 1
add dl, dl
jne 0x57b380
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x57b38b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x57b377
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x57b2f2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x57b3b1
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x57b3bc
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x57b3a8
cmp eax, 0x7d00
jae 0x57b3df
cmp eax, 0x500
jb 0x57b3da
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x57b2f2
cmp eax, 0x7f
ja 0x57b3e2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x57b2f2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x57b40b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x57b2f2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x401372
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x437ac0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x3d8]
xor ebx, ebx
cmp eax, ebx
jne 0x4014fe
mov eax, dword [esi]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x24], 0x3a
mov byte [ebp - 0x23], 0x48
mov byte [ebp - 0x22], 0x6b
mov byte [ebp - 0x21], 0xa2
mov byte [ebp - 0x20], 0x57
mov byte [ebp - 0x1f], 0x27
mov byte [ebp - 0x1e], 0xb1
mov byte [ebp - 0x1d], 0x80
mov byte [ebp - 0x1c], 0xd
mov byte [ebp - 0x1b], 0x50
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x8d
mov byte [ebp - 0x18], 0x6d
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0xb
mov byte [ebp - 0x15], 0xe2
mov byte [ebp - 0x14], 0xc6
mov byte [ebp - 0x13], 0x78
mov byte [ebp - 0x12], 0xff
mov byte [ebp - 0x11], 0x31
mov byte [ebp - 0x10], 0x22
mov byte [ebp - 0xf], 0xcb
mov byte [ebp - 0xe], 0x44
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0xb1
mov byte [ebp - 0xb], 0x6d
mov byte [ebp - 0xa], 0x1b
mov byte [ebp - 9], 0x95
mov byte [ebp - 8], 0xf5
mov byte [ebp - 7], 0x68
mov byte [ebp - 6], 0x8d
mov byte [ebp - 5], 0x6d
cmp eax, 0xffffffff
je 0x4014fc
cmp dword [esi + 0x3dc], ebx
je 0x4014fc
push ebx
push ebx
push 0x1cc
push eax
call dword [0x42b1fc]
cmp eax, 0xffffffff
je 0x4014fc
push edi
push dword [esi + 0x68]
call fcn.0040b889
mov edi, eax
mov eax, dword [esi + 0x68]
add eax, 0x20
push eax
call fcn.0040b889
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
cmp edi, ebx
je 0x4014e7
cmp eax, ebx
je 0x4014f5
push ebx
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [esi + 0x64]
sub ecx, 0x1cc
push ecx
push eax
push dword [esi]
call dword [0x42b200]
test eax, eax
je 0x4014e7
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x24]
push 0x80
push eax
call fcn.00409220
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x128]
push eax
push dword [esi + 0x68]
push edi
push dword [ebp - 0x28]
call fcn.0040a139
mov eax, dword [ebp - 0x30]
add esp, 0x24
mov dword [esi + 0x3d8], edi
mov dword [ebp - 0x2c], edi
cmp eax, ebx
je 0x4014d8
mov ecx, dword [esi + 0x68]
mov dword [eax], ecx
push dword [ebp - 0x28]
call fcn.004113c0
pop ecx
mov eax, dword [ebp - 0x2c]
pop edi
jmp 0x4014fe
cmp dword [ebp - 0x28], ebx
je 0x4014f5
push dword [ebp - 0x28]
call fcn.004113c0
pop ecx
cmp edi, ebx
je 0x4014e1
push edi
jmp 0x4014db
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00411970
leave
ret 4

Function at 0x4118dd
Capabilities:
Get number of processors
Parse pe header

Disassembly:
cmp byte [eax + 0x73], al
imul edi, dword [ebp + 0x42], 0x4f3f5a52
jns 0x411931
bound ebp, qword [eax + 0x72]
daa
jb 0x411925
insb byte es:[edi], dx
dec eax
Function at 0x1004f0b
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call sub.IMM32.dll_ImmGetContext
mov esi, eax
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 0xc], esi
je 0x1005135
push 0x288
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x1004f91
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
and dword [ebp - 0x10], 8
je 0x1004f78
push ebx
push ebx
push 8
push esi
call sub.IMM32.dll_ImmGetCompositionStringW
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x1004f91
test byte [ebp + 0x10], 0x10
je 0x1004f9f
push ebx
push ebx
push 0x10
push esi
call sub.IMM32.dll_ImmGetCompositionStringW
cmp eax, ebx
mov dword [ebp - 8], eax
jge 0x1004fa2
jmp 0x1004f9f
mov eax, 0x800
test eax, ecx
je 0x1004f98
push ebx
push ebx
push eax
push esi
call sub.IMM32.dll_ImmGetCompositionStringW
cmp eax, ebx
mov dword [ebp - 4], eax
jge 0x1004f9f
push esi
push edi
jmp 0x1005130
cmp ecx, ebx
jne 0x1004fa2
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
lea edi, [eax + ecx + 0x2f]
mov eax, dword [esi + 0x240]
cmp eax, ebx
je 0x1004fca
cmp edi, dword [eax]
jbe 0x1004fca
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 0x240], ebx
cmp dword [esi + 0x240], ebx
jne 0x1004feb
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [esi + 0x240], eax
je 0x100512a
mov dword [eax], edi
mov ebx, dword [esi + 0x240]
mov ecx, dword [ebx]
sub ecx, 4
mov edx, ecx
shr ecx, 2
lea edi, [ebx + 4]
mov dword [ebp - 0x18], edi
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 4]
add esi, 0x244
lea edi, [ebx + 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
cmp dword [ebp - 0x10], edi
lea ecx, [ebx + 0x2c]
lea edx, [ebx + eax + 0x2e]
je 0x100507f
mov esi, eax
push esi
push ecx
push 8
push dword [ebp - 0xc]
call sub.IMM32.dll_ImmGetCompositionStringW
mov ecx, esi
shr ecx, 1
lea eax, [ebx + 0x2c]
mov eax, 0x800
test dword [ebp + 0x10], eax
je 0x10050ce
mov esi, dword [ebp - 4]
push esi
push ecx
push eax
push dword [ebp - 0xc]
call sub.IMM32.dll_ImmGetCompositionStringW
mov ecx, esi
shr ecx, 1
cmp esi, edi
lea eax, [ebx + 0x2c]
mov word [eax + ecx*2], di
mov dword [ebx + 0x14], esi
je 0x10050b0
mov dword [ebx + 0x18], 0x2c
mov dword [ebp - 0x24], 0x4b425930
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
mov dword [ebp - 0x1c], ebx
jmp 0x100511c
cmp dword [ebp + 0x10], edi
jne 0x1005121
mov eax, dword [ebp - 4]
mov esi, eax
shr esi, 1
mov word [ecx + esi*2], di
mov ecx, dword [ebp - 8]
mov byte [edx + ecx], 0
mov dword [ebx + 0x14], eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], ecx
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x7a94aa9
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x4f2a7d65
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x402a6c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404034
test esi, esi
jne 0x402aa2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404124
jmp 0x402ac0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402980
mov edi, eax
test esi, esi
je 0x402ac0
cmp dword [ebx], 0
je 0x402ac0
dec esi
jmp 0x402aa9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403154
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46d020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4031ec
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4031cc
xor eax, eax
push ebp
push 0x4031c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403208
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4031cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x46d020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46d020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403eb8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46f04c], 0
je 0x403f19
cmp word [0x46f220], 0xd7b2
jne 0x403ee1
cmp dword [0x46f228], 0
jbe 0x403ee1
mov eax, 0x46f21c
call dword [0x46f238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46d06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403f40
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46d030], 0
jne 0x403f35
push 0
push 0x46d064
push 0x46d06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret