joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407ae4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.004572c0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x407b29
push ebx
call fcn.00450d41
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x407b54
push 6
call fcn.00450d47
add esp, 4
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x407b73
mov eax, 0x46e281
push eax
push 2
mov ebx, 0x138
call fcn.004577f0
add esp, 0x1c
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0x5c
push 1
mov ebx, 0x140
call fcn.00457300
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push dword [ebp - 8]
call fcn.00402187
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x407bd7
push ebx
call fcn.00450d41
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x407be7
push ebx
call fcn.00450d41
add esp, 4
push 0x80000101
push 0
push 0x5c
push 1
mov ebx, 0x140
call fcn.00457300
add esp, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push dword [ebp - 4]
mov ecx, 2
call fcn.004011bf
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x407c2e
push ebx
call fcn.00450d41
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x407c59
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x407c54
push eax
mov ebx, eax
call fcn.00401154
inc eax
push eax
call fcn.00450d3b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x407c75
mov eax, dword [ebp - 4]
test eax, eax
je 0x407c75
push eax
mov ebx, eax
call fcn.00401154
inc eax
push eax
call fcn.00450d3b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x407c88
push ebx
call fcn.00450d41
add esp, 4
mov eax, dword [ebp - 0x1c]
jmp 0x407c90
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x407ca1
push ebx
call fcn.00450d41
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40c0db
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 1
jne 0x40c173
fild dword [ebp + 0x10]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x49bfa7]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fild dword [ebp + 0xc]
fstp qword [ebp - 0x20]
fdiv qword [ebp - 0x20]
fstp qword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
fld qword [ebp - 8]
fsub qword [0x49bfa7]
fcomp qword [0x49bb9f]
fnstsw ax
test ah, 0x41
jne 0x40c151
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x40590000
push 1
fld qword [ebp - 8]
call fcn.0040121b
push eax
push 0x709272
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x190]
jmp 0x40c28b
cmp dword [ebp + 8], 0
je 0x40c18b
cmp dword [ebp + 8], 0xffffffff
je 0x40c18b
xor eax, eax
jmp 0x40c190
mov eax, 1
test eax, eax
je 0x40c28b
cmp dword [ebp + 0x14], 3
jne 0x40c281
push 0x70929a
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov ebx, dword [0x7092d2]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov ebx, dword [0x7092d2]
mov dword [ebp - 0x10], ebx
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx]
test eax, eax
jne 0x40c1db
mov eax, 0x46e281
push eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x40c1f1
mov eax, 0x46e281
push eax
push 2
mov ebx, 0x23c
call fcn.00457880
add esp, 0x1c
mov ebx, dword [0x7092d2]
add ebx, 4
mov dword [ebp - 0xc], ebx
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x40c225
mov eax, 0x46e281
push eax
push 1
mov ebx, 0x244
call fcn.00457870
add esp, 0x10
mov ebx, dword [0x7092d2]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push 5
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WinExec]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40c26a
push 6
call fcn.00450d47
add esp, 4
push 0x709256
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x90]
jmp 0x40c28b
mov dword [0x7092ba], 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40e486
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x70924a]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40e4d3
push 6
call fcn.00450d47
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40e4ea
mov eax, 0x46e35e
jmp 0x40e5e8
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x70924a]
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40e512
push 6
call fcn.00450d47
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40e529
mov eax, 0x46e35e
jmp 0x40e5e8
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40e54b
push 6
call fcn.00450d47
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40e562
mov eax, 0x46e35e
jmp 0x40e5e8
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.00457bb0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40e595
push ebx
call fcn.00450d41
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40e5ac
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40e5c9
push 6
call fcn.00450d47
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40e5e3
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00450d3b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40e5e8
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40e5f9
push ebx
call fcn.00450d41
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40efdd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ebx, dword [0x70925a]
mov dword [ebp - 4], ebx
push 0x46e281
mov ebx, dword [ebp - 4]
push dword [ebx]
call fcn.00402187
add esp, 8
cmp eax, 0
je 0x40f0ae
mov ebx, dword [0x70925a]
mov dword [ebp - 4], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457300
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457300
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40f08e
push 6
call fcn.00450d47
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40f09e
push ebx
call fcn.00450d41
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40f0ae
push ebx
call fcn.00450d41
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x41c7eb
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x41c81b
push 6
call fcn.00450d47
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x41c82f
mov esp, ebp
pop ebp
ret 4
Function at 0x41d077
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
cmp dword [0x70931e], 0
je 0x41d2ba
push dword [ebp + 8]
call fcn.0041d2dc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41d0cf
push ebx
call fcn.00450d41
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [0x7092c6]
call fcn.00402f0e
xor ecx, ecx
push eax
lea eax, [ebp - 0xc]
mov ebx, eax
pop eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
push eax
cmp ecx, eax
jg 0x41d19f
mov ebx, dword [0x7092c6]
call fcn.00402f27
push ebx
push ecx
mov eax, dword [ebp - 0xc]
dec eax
jns 0x41d115
push 4
call fcn.00450d47
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x41d128
push 1
call fcn.00450d47
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x14], ebx
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx]
test eax, eax
jne 0x41d157
mov eax, 0x46e281
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x41d16b
mov eax, 0x46e281
push eax
push 4
mov ebx, 0x148
call fcn.0045b340
add esp, 0x34
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x41d197
mov dword [ebp - 4], 1
jmp 0x41d19f
pop eax
pop ebx
pop ecx
jmp 0x41d0e7
add esp, 0xc
cmp dword [ebp - 4], 1
jne 0x41d2ba
cmp dword [0x70931e], 0
je 0x41d2ba
push 0x70932e
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00401bc9
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 0x14]
push dword [0x70931e]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x41d1fc
push 6
call fcn.00450d47
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x41d2ab
mov dword [ebp - 0x14], esp
push dword [0x70931e]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41d22e
push 6
call fcn.00450d47
add esp, 4
mov dword [0x70931e], 0
mov dword [0x709332], 0
push 0x70601f
push dword [ebp - 8]
push 0x70603a
mov ecx, 3
call fcn.004011bf
add esp, 0xc
mov dword [ebp - 0x14], eax
push 0x30
mov eax, 0x706004
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
push dword [0x7092da]
push 0x709296
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41d29b
push ebx
call fcn.00450d41
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x41d2ab
push ebx
call fcn.00450d41
add esp, 4
push 0x70932e
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, 1
jmp 0x41d2c4
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41d2d5
push ebx
call fcn.00450d41
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x41d2dc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.004572c0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41d321
push ebx
call fcn.00450d41
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0040bb91
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0x200
push 0xd
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41d360
push 6
call fcn.00450d47
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x41d37c
push eax
mov ebx, eax
call fcn.00401154
inc eax
push eax
call fcn.00450d3b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x41d381
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41d392
push ebx
call fcn.00450d41
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x41d6c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov eax, str.D9E0ADE5DCBA765F365DDBF7A8E0AA9F03335306CAFBDF88A7A3093B437CAB9BC6FDD1C90C15267CB7FAAD84DFB60632315EB5EEA5F5CADC
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0041d88a
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41d6fc
push ebx
call fcn.00450d41
add esp, 4
mov ebx, dword [0x70925a]
add ebx, 8
mov dword [ebp - 0x10], ebx
push 0x40
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
push 1
push dword [0x7092da]
push 0x709296
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41d73b
push ebx
call fcn.00450d41
add esp, 4
mov eax, str.DA7DDF26A941AC35C57E853BEA0AEF339C6AC43BBC
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0041dc12
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41d75f
push ebx
call fcn.00450d41
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41d773
push ebx
call fcn.00450d41
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457300
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00402187
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41d7c5
push ebx
call fcn.00450d41
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x41d868
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457300
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457300
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x41d848
push 6
call fcn.00450d47
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41d858
push ebx
call fcn.00450d41
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41d868
push ebx
call fcn.00450d41
add esp, 4
mov eax, 0
jmp 0x41d872
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41d883
push ebx
call fcn.00450d41
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42002b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push dword [ebp + 8]
call fcn.004200c1
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x40
push 0x1000
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x42007e
push 6
call fcn.00450d47
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x420093
add eax, 8
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4200b3
push 6
call fcn.00450d47
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x4200bb
mov esp, ebp
pop ebp
ret 4

Function at 0x4201cc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push esi
mov al, byte [esp + 8]
mov cl, byte [esp + 0xc]
lea edx, [esi + 0x408]
mov byte [esi + 0x40a], cl
mov cl, byte [esp + 0x14]
push ebx
mov byte [edx], al
mov al, byte [esp + 0x14]
mov byte [esi + 0x40b], al
mov al, byte [esp + 0x1c]
mov byte [esi + 0x409], cl
mov cl, byte [esp + 0x20]
mov byte [esi + 0x40c], al
mov al, byte [esp + 0x24]
mov byte [esi + 0x40e], cl
mov cl, byte [esp + 0x28]
mov byte [esi + 0x40f], al
mov eax, dword [edx]
push ebp
lea ebp, [esi + 4]
push edi
mov byte [esi + 0x40d], cl
mov dword [esi + 0x410], eax
mov dword [esi + 0x414], eax
mov ecx, 0x80
xor eax, eax
mov edi, ebp
mov dword [esi + 0x418], 1
mov dword [esi], 0x10317e4
mov dword [esp + 0x18], 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov al, byte [ecx + 1]
xor edi, edi
mov byte [esp + 0x14], al
mov byte [edi + ebp], al
mov eax, dword [esp + 0x14]
xor edx, edx
and eax, 0xff
mov dl, byte [ecx]
xor ebx, ebx
imul edx, eax
mov bl, byte [ecx + 2]
add edx, ebx
imul edx, eax
xor eax, eax
mov al, byte [ecx + 3]
add eax, edx
and eax, 0x800000ff
jns 0x420293
dec eax
or eax, 0xffffff00
inc eax
inc edi
mov byte [esp + 0x14], al
cmp edi, 0x100
jl 0x420261
mov eax, dword [esp + 0x18]
add ecx, 4
add ebp, 0x100
dec eax
mov dword [esp + 0x18], eax
jne 0x420258
mov ecx, 0x80
xor eax, eax
lea edi, [esi + 0x204]
rep stosd dword es:[edi], eax
mov ecx, 0xfffffefc
lea eax, [esi + 0x104]
sub ecx, esi
mov edx, dword [eax - 0x100]
mov edi, dword [eax]
xor edx, edi
mov dword [eax + 0x100], edx
mov edx, dword [eax - 0x100]
mov ebp, dword [eax]
add eax, 4
and edx, ebp
mov dword [eax + 0x1fc], edx
lea edx, [ecx + eax]
cmp edx, 0x100
jl 0x4202d0
xor eax, eax
pop edi
mov word [esi + 0x406], ax
mov word [esi + 0x404], ax
pop ebp
mov eax, esi
pop ebx
pop esi
ret
Function at 0x42470a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x424745
push 6
call fcn.00450d47
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00457a80
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4247a8
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004572a0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4247cc
push 6
call fcn.00450d47
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00457a80
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42482f
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004572a0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x424853
push 6
call fcn.00450d47
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00457a80
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4248b6
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004572a0
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4248be
mov esp, ebp
pop ebp
ret
Function at 0x428d53
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x428d99
push 6
call fcn.00450d47
add esp, 4
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x46e2c7]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.0040121b
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.004572c0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x428dec
push ebx
call fcn.00450d41
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x428e25
push 6
call fcn.00450d47
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x428e41
push eax
mov ebx, eax
call fcn.00401154
inc eax
push eax
call fcn.00450d3b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x428e46
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x428e57
push ebx
call fcn.00450d41
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x430e0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
test ebp, ebp
jle 0x430e86
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov al, byte [ecx + 0x404]
mov dl, byte [eax + ecx + 4]
mov al, byte [esi + edi]
xor al, dl
mov byte [esi + edi], al
mov dl, al
xor eax, eax
mov al, byte [ecx + 0x404]
mov al, byte [eax + ecx + 0x204]
add al, dl
xor edx, edx
mov byte [esi + edi], al
mov dl, byte [ecx + 0x405]
mov dl, byte [edx + ecx + 0x104]
xor dl, al
xor eax, eax
mov byte [esi + edi], dl
mov al, byte [ecx + 0x405]
mov al, byte [eax + ecx + 0x304]
add al, dl
mov dl, al
shr dl, 4
shl al, 4
or dl, al
mov byte [esi + edi], dl
inc word [ecx + 0x404]
inc esi
cmp esi, ebp
jl 0x430e1d
pop edi
pop esi
pop ebp
ret 8
Function at 0x430f73
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
test ebp, ebp
jle 0x430ff4
push ebx
push edi
mov edi, dword [esp + 0x14]
mov dl, byte [esi + edi]
mov al, dl
shr al, 4
shl dl, 4
or al, dl
xor edx, edx
mov byte [esi + edi], al
mov dl, byte [ecx + 0x407]
mov bl, byte [edx + ecx + 0x304]
xor edx, edx
sub al, bl
mov byte [esi + edi], al
mov dl, byte [ecx + 0x407]
mov dl, byte [edx + ecx + 0x104]
xor dl, al
xor eax, eax
mov byte [esi + edi], dl
mov al, byte [ecx + 0x406]
mov ebx, eax
mov al, dl
mov dl, byte [ebx + ecx + 0x204]
sub al, dl
xor edx, edx
mov byte [esi + edi], al
mov dl, byte [ecx + 0x406]
mov dl, byte [edx + ecx + 4]
xor dl, al
mov byte [esi + edi], dl
inc word [ecx + 0x406]
inc esi
cmp esi, ebp
jl 0x430f85
pop edi
pop ebx
pop esi
pop ebp
ret 8
Function at 0x455260
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a2a0
push 0x45d00c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x4552c6
mov byte [ebp - 0x3d], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3d]
jmp 0x45534f
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0x4550
je 0x4552ed
mov byte [ebp - 0x3e], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3e]
jmp 0x45534f
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0xd8]
cmp dword [ebp + 0xc], eax
jb 0x455328
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
add edx, dword [ecx + 0xd8]
mov eax, dword [ebp - 0x3c]
add edx, dword [eax + 0xdc]
cmp dword [ebp + 0xc], edx
jae 0x455328
mov byte [ebp - 0x3f], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3f]
jmp 0x45534f
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x40]
jmp 0x45534f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4553f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x70ca78]
mov dword [ebp - 4], eax
jmp 0x455409
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x455426
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x455400
mov esp, ebp
pop ebp
ret