joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10051420
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10079a30]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100b1428], 0
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
jne 0x10051586
cmp byte [0x100b1429], 0
jne 0x10051586
mov ecx, dword [0x1007a690]
lea edx, [ebp - 8]
push edx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x14]
call eax
mov eax, dword [0x100b1078]
cmp eax, 2
je 0x10051586
cmp eax, 4
je 0x10051586
cmp eax, 3
je 0x10051586
cmp eax, 6
je 0x10051586
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movss xmm1, dword [0x1007942c]
test ax, ax
jns 0x1005153e
cmp byte [0x100b0ef8], 0
je 0x1005153e
mov ecx, dword [edi]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
comiss xmm1, xmm0
jbe 0x1005153e
mov eax, dword [ebp + 0x10]
add eax, ecx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm0, xmm1
jbe 0x1005153e
mov ecx, dword [ebx]
movss xmm2, dword [0x10079430]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
comiss xmm2, xmm0
jbe 0x1005153e
mov eax, dword [ebp + 0x14]
add eax, ecx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm0, xmm2
jbe 0x1005153e
cmp byte [0x100b142b], 0
mov byte [0x100b142a], 1
jne 0x10051547
movd xmm0, dword [edi]
movaps xmm3, xmm1
cvtdq2ps xmm0, xmm0
subss xmm3, xmm0
movss dword [0x10079434], xmm3
movd xmm0, dword [ebx]
cvtdq2ps xmm0, xmm0
mov byte [0x100b142b], 1
subss xmm2, xmm0
movss dword [0x10079438], xmm2
jmp 0x1005154f
cmp byte [0x100b142a], 0
je 0x1005156f
movss xmm3, dword [0x10079434]
subss xmm1, xmm3
cvttss2si eax, xmm1
mov dword [edi], eax
movss xmm0, dword [0x10079430]
subss xmm0, dword [0x10079438]
cvttss2si eax, xmm0
mov dword [ebx], eax
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x10051586
mov byte [0x100b142a], al
mov byte [0x100b142b], al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10059f15
mov esp, ebp
pop ebp
ret
Function at 0x10052030
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10079a30]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100b1428], 0
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
jne 0x10052196
cmp byte [0x100b1429], 0
jne 0x10052196
mov ecx, dword [0x1007a690]
lea edx, [ebp - 8]
push edx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x14]
call eax
mov eax, dword [0x100b1078]
cmp eax, 2
je 0x10052196
cmp eax, 4
je 0x10052196
cmp eax, 3
je 0x10052196
cmp eax, 6
je 0x10052196
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movss xmm1, dword [0x1007942c]
test ax, ax
jns 0x1005214e
cmp byte [0x100b0ef8], 0
je 0x1005214e
mov ecx, dword [edi]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
comiss xmm1, xmm0
jbe 0x1005214e
mov eax, dword [ebp + 0x10]
add eax, ecx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm0, xmm1
jbe 0x1005214e
mov ecx, dword [ebx]
movss xmm2, dword [0x10079430]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
comiss xmm2, xmm0
jbe 0x1005214e
mov eax, dword [ebp + 0x14]
add eax, ecx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm0, xmm2
jbe 0x1005214e
cmp byte [0x100b142d], 0
mov byte [0x100b142c], 1
jne 0x10052157
movd xmm0, dword [edi]
movaps xmm3, xmm1
cvtdq2ps xmm0, xmm0
subss xmm3, xmm0
movss dword [0x10079434], xmm3
movd xmm0, dword [ebx]
cvtdq2ps xmm0, xmm0
mov byte [0x100b142d], 1
subss xmm2, xmm0
movss dword [0x10079438], xmm2
jmp 0x1005215f
cmp byte [0x100b142c], 0
je 0x1005217f
movss xmm3, dword [0x10079434]
subss xmm1, xmm3
cvttss2si eax, xmm1
mov dword [edi], eax
movss xmm0, dword [0x10079430]
subss xmm0, dword [0x10079438]
cvttss2si eax, xmm0
mov dword [ebx], eax
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x10052196
mov byte [0x100b142c], al
mov byte [0x100b142d], al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10059f15
mov esp, ebp
pop ebp
ret

Function at 0x100521b0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x100b1b0c]
test eax, eax
je 0x100521cc
nop dword [eax]
cmp dword [eax + 4], 0
jne 0x10052222
mov eax, dword [eax]
test eax, eax
jne 0x100521c0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1005221f
push esi
push edi
xor edi, edi
mov dword [eax + 8], 0
lea edx, [eax + 0x20]
lea esi, [edi + 0x20]
mov dword [edx], edi
mov ecx, edx
mov dword [eax + 4], edx
add esi, 0x20
add edx, 0x20
mov edi, ecx
cmp esi, 0xfe0
jbe 0x100521f5
mov ecx, dword [0x100b1b0c]
mov dword [eax], ecx
mov dword [0x100b1b0c], eax
pop edi
pop esi
test eax, eax
jne 0x10052222
xor eax, eax
ret
mov edx, dword [eax + 4]
mov ecx, dword [edx]
inc dword [eax + 8]
mov dword [eax + 4], ecx
mov eax, edx
ret
Function at 0x10052c20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10079a30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
imul esi, eax, 0x2c
push edi
add esi, dword [0x100b1b00]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10052c80
pop edi
mov eax, 0xa
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10059f15
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x10052ca5
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10052cc6
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10052cc6
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10052cc0
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10052cc6
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, byte [esi + 0x14]
and bl, 1
and cl, 0xfd
mov al, bl
add al, al
shl bl, 2
or cl, al
xor eax, eax
and cl, 0xfb
or cl, bl
mov byte [esi + 0x14], cl
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.10059f15
mov esp, ebp
pop ebp
ret
Function at 0x10052db0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10079a30]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x10052ea8
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x10052ea1
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop dword [eax]
cmp dword [ebp - 0x20], 0x10
jb 0x10052e88
call ebx
cmp dword [ebp - 0x14], eax
jne 0x10052e88
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10052e88
mov edx, dword [esi]
test edx, edx
jne 0x10052e51
push 0x200
push edx
mov dword [esi + 4], 0x80
push dword [0x100b1684]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10052ea1
jmp 0x10052e7c
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10052e7c
shl eax, 3
push eax
push edx
push 0
push dword [0x100b1684]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10052ea1
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10052e10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x10052eec
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x10052eec
mov eax, dword [esi]
push dword [eax + ebx*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10052ee6
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.10053210
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x10052eb4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10059f15
mov esp, ebp
pop ebp
ret

Function at 0x10053380
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi], 0
je 0x100533d0
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x100533bf
push ebx
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100533b8
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x10053395
pop ebx
push dword [edi]
push 0
push dword [0x100b1684]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
pop ebp
ret
Function at 0x10055d50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f5c5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10079a30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x24], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push edx
push eax
call fcn.10055ca0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10055dda
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x10055f24
cmp dword [ebx + 8], 0xfffffff
je 0x10055f3a
lea eax, [ebx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 0
call fcn.100599b4
mov esi, eax
add esp, 4
mov dword [ebp - 0x28], esi
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10065130]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10065130]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10055ed7
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1005a0c0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x10055eb9
cmp eax, 0x200
jae 0x10055eb7
shl eax, 3
cmp eax, ecx
jae 0x10055eb9
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10056710
push dword [ebp - 0x1c]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10055ca0
mov edx, dword [eax]
jmp 0x10055eda
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x20]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x1c]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x10055f05
mov dword [ecx + eax*8], esi
jmp 0x10055f17
cmp ebx, edx
jne 0x10055f0e
mov dword [ecx + eax*8], esi
jmp 0x10055f1b
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10055f1b
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x24]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x10056710
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x1005686b
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10056640
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1005683e
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x100567c4
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10056831
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x100567fe
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x100567f6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x10056831
cmp ebx, edx
je 0x1005680e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10056847
cmp ebx, edx
jne 0x10056802
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 0x10]
mov eax, ecx
cmp ecx, esi
jne 0x10056772
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10056831
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x10058af0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x10058afe
mov al, 1
pop ebp
ret
cmp eax, 1
jne 0x10058b14
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
pop ebp
ret
cmp eax, 2
jne 0x10058b28
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
pop ebp
ret

Function at 0x100591a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x100591df
sub eax, 1
jne 0x100591f0
push eax
push eax
push dword [ebp + 8]
push 0x10058f50
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100591f0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc
call fcn.10030940
call fcn.10058ef0
mov ecx, eax
call fcn.10009380
mov eax, 1
pop ebp
ret 0xc
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406037
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x406046
pop dword [ebp - 0x40]
mov eax, 0x1fe69272
add eax, 0xe059cdd4
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xad9601f3
add dword [ebp - 0x50], 0xa0bc4358
mov dword [ebp - 0x4c], 0x1b3ff535
sub dword [ebp - 0x4c], 0xe90ca8f0
mov dword [ebp - 0x48], 0x73cfa214
sub dword [ebp - 0x48], 0x27835de6
mov dword [ebp - 0x44], 0xa7dca4d6
sub dword [ebp - 0x44], 0xa7dca4d6
lea eax, [ebp - 0x50]
push eax
mov eax, 0x1534ff77
sub eax, 0x14f42f23
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xf4a88fb0
sub dword [ebp - 0x50], 0x8036265a
mov dword [ebp - 0x4c], 0xed578cb
add dword [ebp - 0x4c], 0x3296e8aa
mov dword [ebp - 0x48], 0x62f18ce
add dword [ebp - 0x48], 0x5d40539e
mov dword [ebp - 0x44], 0xb61fcb7f
sub dword [ebp - 0x44], 0xb61fcb7f
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x6f124475
add eax, 0x912e8bd7
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3aedb
push 0
call eax
mov ecx, 0x59ca934e
sub ecx, 0x59ca45e7
xor esi, esi
add esi, eax
mov edx, 0xa91daa97
add edx, 0x57240569
add edx, dword [ebp - 0x40]
mov edi, 0x2e17b194
add edi, 0xf77e0cd9
sub dword [ebp - 0x30], 0x62cfd284
mov ebx, dword [edx]
xor dword [ebp - 0x20], eax
add ebx, edi
mov dword [esi], ebx
add dword [ebp - 0x3c], edi
add esi, 0x3c2c693
add esi, 0xfc3d3971
add edx, 4
loop 0x40616a
add eax, 0x1286f
mov ebx, eax
add eax, 0x9cd392f0
sub eax, 0x9cd392eb
mov ecx, 0xbc111f21
sub ecx, 0xbbd11f21
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x452cbe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x452ccd
pop dword [ebp - 0x24]
mov eax, 0x28015895
sub eax, 0x27bc2bc8
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xaad705b1
sub dword [ebp - 0x34], 0x5c84c066
mov dword [ebp - 0x30], 0xd562b485
add dword [ebp - 0x30], 0x5cd097c0
mov dword [ebp - 0x2c], 0xea14be72
sub dword [ebp - 0x2c], 0x9dc87a44
mov dword [ebp - 0x28], 0xfb9e7e5d
sub dword [ebp - 0x28], 0xfb9e7e5d
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xab80f09d
sub dword [ebp - 0x34], 0x370e8747
mov dword [ebp - 0x30], 0x33dc8ac7
sub dword [ebp - 0x30], 0xf2702952
mov dword [ebp - 0x2c], 0xe3f40059
add dword [ebp - 0x2c], 0x7f7b6c13
mov dword [ebp - 0x28], 0x88bc5979
add dword [ebp - 0x28], 0x7743a687
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x35261910
add eax, 0xcb1f9770
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x4feca
push 0
call eax
mov ecx, 0x402b83a1
add ecx, 0xbfd4ceed
mov ebx, eax
mov esi, 0x476000
add esi, dword [ebp - 0x24]
mov edi, 0x97d84364
mov dword [ebp - 0x20], 0xeca39be3
mov edx, dword [esi]
xor dword [ebp - 4], ecx
sub edx, edi
sub dword [ebp - 0x18], 0x585ff9f9
mov dword [ebx], edx
add dword [ebp - 0x14], 0x79003105
add ebx, 0x8fdcfa6b
sub ebx, 0x8fdcfa67
add esi, 0xe8d379c9
add esi, 0x172c863b
loop 0x452dde
add eax, 0x13d0b
mov ebx, eax
add eax, 5
mov ecx, 0xe2f1ac25
add ecx, 0x1d4e53db
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401854
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x124
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x10c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
cmp byte [ebp - 0x10c], 0
mov eax, dword [ebx + 0x5c]
je 0x40189f
mov dword [esp + 4], 1
jmp 0x4018a7
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.USER32.dll_EnableWindow
push ebx
push ebx
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call fcn.004163e2
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x401b18
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x120
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x10c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov eax, dword [ebx + 0x48]
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00401abe
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00401a42
lea esp, [ebp - 8]
pop ebx
pop esi
leave
ret

Function at 0x401b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call fcn.00401b18
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.004018ee
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x403b68
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.DLL_CreateThread
sub esp, 0x18
mov edx, eax
mov dword [ebx + 0xd8], eax
or eax, 0xffffffff
test edx, edx
je 0x401c29
mov dword [esp + 0xc], 0x403a78
mov dword [esp + 8], 0x64
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.USER32.dll_SetTimer
sub esp, 0x10
mov dword [ebx + 0xdc], eax
cmp eax, 1
sbb eax, eax
mov ebx, dword [ebp - 4]
leave
ret