joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406670
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x21c], ecx
mov ecx, dword [ebp - 0x21c]
call fcn.004088b0
test eax, eax
je 0x4066a2
mov eax, 1
jmp 0x406747
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4066c1
xor eax, eax
jmp 0x406747
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push str.RPCSS
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push 1
push 3
push 0x10
push 0xf01ff
mov edx, dword [ebp - 0x21c]
add edx, 0x230
push edx
mov eax, dword [ebp - 0x21c]
add eax, 0x230
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40672e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x406747
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00407458
mov esp, ebp
pop ebp
ret

Function at 0x406760
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.004088b0
test eax, eax
jne 0x40677f
mov eax, 1
jmp 0x40680a
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40679b
xor eax, eax
jmp 0x40680a
push 0x10020
mov eax, dword [ebp - 0x2c]
add eax, 0x230
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4067ca
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x40680a
lea eax, [ebp - 0x28]
push eax
push 1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 8], 0
je 0x406808
mov eax, 1
jmp 0x40680a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40795a
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
pushal
push ebp
mov ebp, esp
sub esp, 0x108
Function at 0x407964
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp - 8], 1
mov eax, 0xd
xor ecx, ecx
inc ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 6
mov dword [ebp - 0x34], 0xc
mov eax, 0x6c
mov ecx, 0xc
mov edx, 0x2aaaaaab
push ecx
mov ecx, eax
imul edx
sar edx, 1
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x54], 0x3145
xor dword [eax], eax
add bh, al
inc ebp
mov esp, 0xfa154a05
mov eax, 0x151
mul dword [ebp - 0x54]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0x6756
add dword [ebp - 0x1c], 0x5363
add dword [ebp - 0x1c], 0x2cf47
mov dword [ebp - 0x48], 0x26fb
dec dword [ebp - 0x44]
mov esp, 0x2de84581
and dword [eax], eax
add byte [ebx + 0x4503c845], cl
hlt
sub eax, 0xf
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x48]
sub dword [ebp - 0x18], eax
mov dword [ebp - 4], 0x410102
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x88], eax
mov eax, 0x24
mov ecx, dword [ebp - 0x38]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x88]
xor edx, edx
div ecx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x58], eax
mov eax, 0x27
mov ecx, dword [ebp - 0x14]
cdq
idiv ecx
mov edi, eax
add edi, dword [ebp - 0x48]
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
mov al, byte [edx + eax]
mov byte [ebp - 0x1d], al
movzx eax, byte [ebp - 0x1d]
mov edx, dword [ebp - 0x44]
add edx, dword [ebp - 0x58]
and edx, 0xff
xor eax, edx
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
mov cl, byte [ebp - 0x1d]
mov byte [edx + eax], cl
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x48]
cmp dword [ebp - 0x24], eax
jb 0x407a3f
inc dword [ebp - 0x3c]
mov ebx, 0x49b000
mov eax, dword [ebp - 0xc]
sub eax, 2
cmp dword [ebp - 0x3c], eax
jbe 0x4079fc
mov dword [ebp - 0x5c], 0x437502
mov esi, dword [ebp - 0x14]
sub esi, 0xd
cmp esi, 0x2731c
jae 0x407ab2
mov eax, dword [ebp - 4]
mov al, byte [eax + esi]
mov byte [ebx + esi], al
inc esi
jmp 0x407a9e
mov dword [ebp - 0x60], 0x5ae000
mov eax, dword [ebp - 0xc]
sub eax, 6
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x5c]
mov al, byte [edx + eax]
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x60]
mov cl, byte [ebp - 0x1d]
mov byte [edx + eax], cl
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xd5d0
jb 0x407ac2
mov dword [ebp - 0x64], 0x448382
mov dword [ebp - 0x68], 0x10000000
inc ebp
cwde
add byte [eax], al
add byte [eax], dl
Function at 0x4079a9
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
mov dword [ebp - 8], 1
mov eax, 0xd
xor ecx, ecx
inc ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 6
mov dword [ebp - 0x34], 0xc
mov eax, 0x6c
mov ecx, 0xc
mov edx, 0x2aaaaaab
push ecx
mov ecx, eax
imul edx
sar edx, 1
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x54], 0x3145
xor dword [eax], eax
add bh, al
inc ebp
mov esp, 0xfa154a05
mov eax, 0x151
mul dword [ebp - 0x54]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0x6756
add dword [ebp - 0x1c], 0x5363
add dword [ebp - 0x1c], 0x2cf47
mov dword [ebp - 0x48], 0x26fb
dec dword [ebp - 0x44]
mov esp, 0x2de84581
and dword [eax], eax
add byte [ebx + 0x4503c845], cl
hlt
sub eax, 0xf
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x48]
sub dword [ebp - 0x18], eax
mov dword [ebp - 4], 0x410102
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x88], eax
mov eax, 0x24
mov ecx, dword [ebp - 0x38]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x88]
xor edx, edx
div ecx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x58], eax
mov eax, 0x27
mov ecx, dword [ebp - 0x14]
cdq
idiv ecx
mov edi, eax
add edi, dword [ebp - 0x48]
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
mov al, byte [edx + eax]
mov byte [ebp - 0x1d], al
movzx eax, byte [ebp - 0x1d]
mov edx, dword [ebp - 0x44]
add edx, dword [ebp - 0x58]
and edx, 0xff
xor eax, edx
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
mov cl, byte [ebp - 0x1d]
mov byte [edx + eax], cl
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x48]
cmp dword [ebp - 0x24], eax
jb 0x407a3f
inc dword [ebp - 0x3c]
mov ebx, 0x49b000
mov eax, dword [ebp - 0xc]
sub eax, 2
cmp dword [ebp - 0x3c], eax
jbe 0x4079fc
mov dword [ebp - 0x5c], 0x437502
mov esi, dword [ebp - 0x14]
sub esi, 0xd
cmp esi, 0x2731c
jae 0x407ab2
mov eax, dword [ebp - 4]
mov al, byte [eax + esi]
mov byte [ebx + esi], al
inc esi
jmp 0x407a9e
mov dword [ebp - 0x60], 0x5ae000
mov eax, dword [ebp - 0xc]
sub eax, 6
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x5c]
mov al, byte [edx + eax]
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x60]
mov cl, byte [ebp - 0x1d]
mov byte [edx + eax], cl
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xd5d0
jb 0x407ac2
mov dword [ebp - 0x64], 0x448382
mov dword [ebp - 0x68], 0x10000000
inc ebp
cwde
add byte [eax], al
add byte [eax], dl
Function at 0x4013a8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [ebp + 8]
mov esi, dword [0x413570]
mov dword [ebp - 0x10], eax
lea edi, [esi + 0x15180]
sub edi, 2
cmp edi, esi
jb 0x4013d0
cmp word [edi], 0x20
je 0x4013c3
xor eax, eax
cmp esi, edi
ja 0x4013f7
lea edx, [esi + 0x1e0]
sub edx, 2
cmp edx, esi
jb 0x4013e9
cmp word [edx], 0x20
je 0x4013dc
sub edx, esi
lea eax, [eax + edx + 6]
add esi, 0x1e0
jmp 0x4013d2
add eax, 2
push eax
push 0x2000
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x40141d
push 0x30
push 0x412711
push 0x412718
jmp 0x40149e
push dword [ebp - 0x14]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebp - 0x18], eax
mov esi, dword [0x413570]
cmp esi, edi
ja 0x401476
lea edx, [esi + 0x1e0]
sub edx, 2
cmp edx, esi
jb 0x401445
cmp word [edx], 0x20
je 0x401438
mov ebx, edx
sub ebx, esi
lea eax, [ebx + 2]
push eax
push esi
add esi, 0x1e0
push dword [ebp - 0x18]
call sub.msvcrt.dll_memcpy
add ebx, dword [ebp - 0x18]
add esp, 0xc
mov word [ebx + 2], 0xd
mov word [ebx + 4], 0xa
add ebx, 6
mov dword [ebp - 0x18], ebx
jmp 0x40142e
mov eax, dword [ebp - 0x18]
mov word [eax], 0
push dword [ebp - 0x14]
call sub.KERNEL32.dll_GlobalUnlock
push dword [ebp - 0x10]
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x4014ae
push 0x30
push 0x412711
push 0x412739
push dword [ebp - 0x10]
call sub.USER32.dll_MessageBoxA
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.USER32.dll_EmptyClipboard
push dword [ebp - 0x14]
push 0xd
call sub.USER32.dll_SetClipboardData
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00412410

Function at 0x402f19
Capabilities:
Check for software breakpoints
Check if file exists
Get file size
Read file on windows

Disassembly:
mov esp, dword [0x413174]
call fcn.0040794c
mov al, byte [0x4131b3]
and al, 0xf
or al, 0x30
test byte [0x412cac], 0xff
je 0x402531
or al, 8
mov byte [0x4131b3], al
call fcn.00403040
mov edx, dword [0x41315c]
push edx
call fcn.00408459
call fcn.00402e21
pop esi
mov ebx, dword [0x413160]
mov cl, 1
push ebx
call fcn.00402bc9
pop esi
xor ah, ah
mov word [ebx], ax
jmp case.0x4036a3.11
pop dword [0x41317c]
mov edx, dword [0x413180]
or edx, edx
jne 0x402f2f
mov edx, dword [0x413174]
mov esp, edx
mov byte [0x4131b2], al
or al, al
mov eax, dword [0x413190]
mov dword [0x4131a8], eax
je 0x402f53
mov esi, dword [0x413184]
or esi, esi
je 0x402f5e
jmp case.0x4036a3.11
mov edx, dword [0x41317c]
call fcn.00407af3
mov esp, dword [0x413174]
call fcn.00407872
call fcn.00402df5
call fcn.00402e5a
call fcn.00402ea3
call fcn.00402ec4
mov eax, dword [0x413190]
cmp eax, dword [0x413164]
jb 0x402f91
xor ebx, ebx
call fcn.0040b587
call fcn.00402df5
jmp 0x402512

Function at 0x40433c
Capabilities:
Check for software breakpoints
Check if file exists
Get file size
Read file on windows

Disassembly:
jmp fcn.00402efe
call fcn.004058d3
jne 0x404355
call fcn.004030b0
jne 0x404351
mov esi, ebx
jmp 0x40365b
mov al, 0x29
jmp 0x404321
mov al, 0x10
jmp 0x404321
Function at 0x408459
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov al, byte [ebx]
call fcn.0040888c
inc ebx
cmp al, 0xd
jne 0x40843b
cmp al, cl
jne 0x4079bd
mov al, 0xa
call fcn.0040888c
xor al, al
ret
or ebp, 0xffffffff
mov ebx, edx
mov byte [ebx], 0xd
xor ch, ch
mov al, cl
or ch, ch
jne 0x408482
mov eax, dword [0x41326c]
sub eax, dword [0x413268]
cdq
idiv dword [0x413328]
mov ch, al
call fcn.0040860b
mov cl, al
test byte [0x41340b], 0x81
jne 0x40843b
cmp byte [0x41331a], 0
jne 0x4084f2
cmp al, 0xd
je 0x40843b
cmp al, 0x8d
je 0x408461
cmp al, 0x8c
je 0x408461
dec ch
push 0x408463
cmp al, 0x8b
je 0x408501
cmp al, 0x8a
je 0x40853d
mov ch, 0xff
cmp al, 0xa
je 0x408518
cmp al, 0x15
je 0x4084fc
cmp al, 0x83
je 0x40853d
cmp al, 0x82
je 0x408501
xor ch, ch
cmp al, 8
je 0x4084fc
cmp al, 0x7f
je 0x4084fc
cmp al, 0x88
je 0x408501
cmp al, 0x87
je 0x408518
cmp al, 0x89
je 0x40853d
cmp al, 0x86
je 0x4085aa
cmp al, 0x16
je 0x4085b9
cmp al, 0x20
jae 0x40856d
pop edx
call fcn.0040888c
jmp 0x408461
stc
mov al, 0x7f
jmp 0x408503
mov al, 8
inc bl
dec bl
je 0x40859b
pushfd
call fcn.0040888c
popfd
dec bl
jae 0x40856c
cmp byte [ebx], 0xd
je 0x40859b
mov edx, ebx
mov al, byte [ebx + 1]
mov byte [ebx], al
inc ebx
cmp al, 0xd
jne 0x40851f
mov ebx, edx
xor dh, dh
mov al, byte [ebx]
inc dh
inc ebx
cmp al, 0xd
je 0x408559
call fcn.00408772
jmp 0x40852d
mov al, byte [ebx]
cmp al, 0xd
je 0x40859b
mov dh, byte [ebx]
mov byte [ebx], al
inc bl
je 0x40858f
call fcn.00408772
mov al, 0xd
cmp al, dh
jne 0x40856c
mov byte [ebx], al
ret
mov al, 0x20
call fcn.00408772
mov al, 8
call fcn.0040888c
dec ebx
dec dh
jne 0x408562
ret
test byte [0x41329a], 1
jne 0x408543
cmp byte [ebx], 0xd
je 0x408543
mov edx, ebx
mov dl, 0xff
xchg ebx, edx
mov ah, 0xd
mov byte [ebx], ah
dec ebx
cmp bl, dl
je 0x40859e
mov ah, byte [ebx - 1]
jmp 0x408583
dec bl
mov byte [ebx], 0xd
mov al, 7
call fcn.0040888c
xor ch, ch
ret
mov ebx, edx
mov byte [ebx], al
inc ebx
call fcn.00408772
jmp 0x40852b
xor byte [0x41329a], 1
pushal
call fcn.0040d7f2
popal
ret
xchg dword [0x413448], esp
push dword [0x4133a8]
call sub.USER32.dll_OpenClipboard
push 1
call sub.USER32.dll_GetClipboardData
or eax, eax
je 0x4085fd
push eax
push eax
call sub.KERNEL32.dll_GlobalLock
mov ecx, eax
xchg dword [0x413448], esp
mov al, byte [ecx]
inc ecx
cmp al, 0x20
jb 0x4085f2
call 0x40856d
jmp 0x4085e4
xchg dword [0x413448], esp
call sub.KERNEL32.dll_GlobalUnlock
call fcn.00412410
xchg dword [0x413448], esp
xor ch, ch
ret
Function at 0x40b18a
Capabilities:
Check if file exists
Read file on windows

Disassembly:
or eax, eax
je 0x40b22f
push eax
pushal
lea eax, [esp + 0x20]
xchg dword [0x413448], esp
push 0
push eax
push ecx
push edx
push ebx
call sub.KERNEL32.dll_ReadFile
xchg dword [0x413448], esp
or al, al
je 0x40b20f
popal
mov ebx, eax
call fcn.0040b587
pop eax
ret

Function at 0x40b4a3
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebx
sub ebx, 5
jb 0x40b4fe
cmp ebx, 8
jae 0x40b4f1
mov ecx, dword [0x4131d4]
add ch, bl
lea ebx, [ebx*4 + 0x4131e8]
mov cl, byte [ebx + 0x20]
cmp cl, byte [ebx + 0x21]
jne 0x40b4dc
xor cl, cl
cmp dword [ebx], 0
je 0x40b4ec
push eax
call fcn.0040c2bc
je 0x40b49e
call fcn.0040c335
je 0x40b49e
pop eax
mov byte [ecx], al
inc cl
mov byte [ebx + 0x20], cl
mov byte [ebx + 0x22], cl
or byte [ebx + 0x23], 0x80
pop ebx
ret
jmp fcn.0040b2c8
add ebx, 5
cmp ebx, 0x11
jae 0x40b50a
sub ebx, 0xd
jmp 0x40b503
add ebx, 4
jae 0x40b4ec
mov ebx, dword [ebx*4 + 0x4131d8]
push eax
mov ecx, esp
push eax
mov eax, esp
pushal
mov edi, dword [0x413520]
xchg dword [0x413448], esp
push edi
push 0
push 0
push 0
push 0
mov edx, esp
jb 0x40b52c
xor edx, edx
push edx
push eax
push 1
push ecx
push ebx
push edi
call sub.KERNEL32.dll_ResetEvent
call sub.KERNEL32.dll_WriteFile
or al, al
jne 0x40b567
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3e5
mov al, 0
jne 0x40b567
test byte [0x41340b], 0x81
jne 0x40b57d
push 0xa
push edi
call sub.KERNEL32.dll_WaitForSingleObject
sub eax, 0x102
je 0x40b54f
add esp, 0x14
or al, al
xchg dword [0x413448], esp
popal
pop ecx
pop eax
pop ebx
je 0x40b20f
ret
push 1
push ebx
call sub.KERNEL32.dll_PurgeComm
jmp 0x40b567

Function at 0x40b587
Capabilities:
Check if file exists

Disassembly:
or ebx, ebx
jne 0x40b5e0
push ecx
push edi
mov edi, 0x4131e8
mov ebx, 5
mov ecx, 8
mov eax, dword [edi]
or eax, eax
je 0x40b5b7
cmp ebx, dword [0x41322c]
je 0x40b5b7
cmp ebx, dword [0x413228]
je 0x40b5b7
call fcn.0040b5ec
add edi, 4
inc ebx
loop 0x40b59c
mov edi, 0x4131d8
mov ebx, 1
mov ecx, 4
mov eax, dword [edi]
or eax, eax
je 0x40b5d7
call fcn.0040b5ec
add edi, 4
inc ebx
loop 0x40b5cc
pop edi
pop ecx
ret
call fcn.0040b5ec
je 0x40b20f
ret

Function at 0x40b5ec
Capabilities:
Check if file exists

Disassembly:
pushal
mov eax, ebx
sub ebx, 5
jb 0x40b635
cmp ebx, 8
jae 0x40b61f
mov ecx, dword [0x4131d4]
add ch, bl
lea ebx, [ebx*4 + 0x4131e8]
cmp dword [ebx], 0
je 0x40b645
call fcn.0040c2bc
je 0x40b633
xor eax, eax
mov dword [ebx + 0x20], eax
xchg dword [ebx], eax
or eax, eax
je 0x40b645
xchg dword [0x413448], esp
push eax
call sub.KERNEL32.dll_CloseHandle
xchg dword [0x413448], esp
or al, al
popal
ret
add ebx, 4
jae 0x40b645
lea ebx, [ebx*4 + 0x4131d8]
xor eax, eax
jmp 0x40b619
jmp fcn.0040b2c8

Function at 0x40b64a
Capabilities:
Check if file exists
Encode data using xor

Disassembly:
push eax
call fcn.0040bca2
pop eax
mov ebx, 3
Function at 0x40b91f
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ecx, ebx
sub ebx, 5
jb fcn.0040b2c8
cmp ebx, 8
jae 0x40b957
mov ecx, dword [0x4131d4]
add ch, bl
lea ebx, [ebx*4 + 0x4131e8]
cmp dword [ebx], 0
je fcn.0040b2c8
push eax
call fcn.0040c2bc
pop eax
je 0x40b9b0
and dword [ebx + 0x20], 0
mov ecx, dword [ebx]
xchg dword [0x413448], esp
push edx
mov edx, esp
push 0
push edx
push eax
push ecx
call sub.KERNEL32.dll_SetFilePointer
pop edx
xchg dword [0x413448], esp
mov ebx, dword [esp]
push eax
push edx
call fcn.0040b9b5
pop ebx
pop ecx
cmp edx, ebx
jne 0x40b983
cmp eax, ecx
pop ebx
jb 0x40b98c

Function at 0x40b987
Capabilities:
Check if file exists
Clear file content

Disassembly:
ret
call fcn.0040b91f
mov eax, ebx
cmp eax, 0xd
jae 0x40b99a
mov eax, dword [ebx*4 + 0x4131d4]
xchg dword [0x413448], esp
push eax
call sub.KERNEL32.dll_SetEndOfFile
xchg dword [0x413448], esp
or al, al
jne 0x40b986
jmp 0x40b20f

Function at 0x40b9b5
Capabilities:
Check if file exists
Get file size

Disassembly:
push ebx
mov eax, ebx
sub ebx, 5
jb 0x40ba00
cmp ebx, 8
jae 0x40b9d1
mov eax, dword [ebx*4 + 0x4131e8]
or eax, eax
je fcn.0040b2c8
xchg dword [0x413448], esp
push edx
push esp
push eax
call sub.KERNEL32.dll_GetFileSize
pop edx
xchg dword [0x413448], esp
mov ebx, dword [esp]
push edx
push eax
call fcn.0040b8a0
pop ecx
pop ebx
cmp edx, ebx
jne 0x40b9f8
cmp eax, ecx
jae 0x40b9fe
mov eax, ecx
mov edx, ebx
pop ebx
ret
add ebx, 4
jae fcn.0040b2c8
mov ebx, dword [ebx*4 + 0x4131d8]
push esi
push edi
push ebp
xchg dword [0x413448], esp
push 0x1f
mov esi, esp
sub esp, 0xc
mov edi, esp
push edi
push esi
push ebx
call sub.KERNEL32.dll_ClearCommError
mov ecx, dword [esp + 4]
add esp, 0x10
xchg dword [0x413448], esp
pop ebp
pop edi
pop esi
pop ebx
or al, al
je 0x40b20f
mov eax, ecx
xor edx, edx
ret

Function at 0x40bdae
Capabilities:
Create process on windows

Disassembly:
pushal
xchg dword [0x413448], esp
push ebp
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 0
call sub.KERNEL32.dll_CreateProcessA
xchg dword [0x413448], esp
or al, al
popal
ret
Function at 0x40cb39
Capabilities:
Log keystrokes via polling

Disassembly:
ret
test byte [0x41329a], 8
je 0x40cb35
cmp dword [0x41336c], 0
je 0x40cb35
push eax
call fcn.0040d02b
pop eax
or ah, ah
jne 0x40cb7a
cmp al, 0xc
je 0x40ce2f
cmp al, 8
je 0x40cbe0
cmp al, 9
je 0x40cbe4
cmp al, 0xa
je 0x40cbe8
cmp al, 0xb
je 0x40cbec
cmp al, 0xd
je 0x40cbf0
cmp al, 0x1e
je 0x40cbf4
cmp al, 0x20
jb 0x40cb35
xchg dword [0x413448], esp
push eax
mov ebx, esp
sub esp, 8
mov eax, esp
push eax
push 1
push ebx
push dword [0x41336c]
call fcn.0040e3ad
mov eax, dword [0x413244]
test byte [0x4131cc], 2
je 0x40cbae
add eax, dword [0x413330]
sub eax, dword [esp]
push 0
push 1
push ebx
push 0
push 0
push dword [0x413248]
push eax
push dword [0x41336c]
call fcn.0040e3bf
mov esi, esp
xchg dword [0x413448], esp
mov al, 0x40
call fcn.0040cc2b
add dword [0x413448], 0xc
ret
mov al, 6
jmp fcn.0040cc26
mov al, 0
jmp fcn.0040cc26
mov al, 8
jmp fcn.0040cc26
mov al, 0xe
jmp fcn.0040cc26
mov al, 0xc0
jmp fcn.0040cc26
xchg dword [0x413448], esp
mov ebx, dword [0x41336c]
push ebx
call sub.GDI32.dll_EndPage
push ebx
call sub.GDI32.dll_EndDoc
xor eax, eax
mov dword [0x41324c], eax
xchg dword [0x413448], esp
ret

Function at 0x40cc2b
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, 0x413244
mov ebx, dword [0x413338]
mov ebp, dword [0x413340]
mov ecx, dword [0x41333c]
mov edx, dword [0x413344]
or al, 0x10
jmp fcn.0040cca0

Function at 0x40d02b
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x41324c]
or eax, eax
jne 0x40d02a
xchg dword [0x413448], esp
sub esp, 0x14
mov edi, esp
mov ecx, 0x14
xor al, al
rep stosb byte es:[edi], al
mov byte [esp], 0x14
mov dword [esp + 4], 0x412700
mov eax, esp
push eax
mov ebx, dword [0x41336c]
push ebx
call sub.GDI32.dll_StartDocA
mov dword [0x41324c], eax
add esp, 0x14

Function at 0x40d094
Capabilities:
Log keystrokes via polling

Disassembly:
xchg dword [0x413448], esp
push 0x13
call sub.USER32.dll_GetAsyncKeyState
or ah, ah
js 0x40d0be
push 0x10
call sub.USER32.dll_GetAsyncKeyState
or ah, ah
jns 0x40d0be
push 0xa
call sub.KERNEL32.dll_Sleep
push 0x11
call sub.USER32.dll_GetAsyncKeyState
xchg dword [0x413448], esp
or ah, ah
jns 0x40d0cf
call fcn.00407999
je fcn.0040d094
ret
Function at 0x4119ac
Capabilities:
Decompress data using aplib
Packed with generic packer
Read file on windows

Disassembly:
and dword [esp + 0x14], 1
je sub.KERNEL32.dll_ReadFile
pushal
mov ebp, esp
mov edx, dword [ebp + 0x24]
mov edi, dword [ebp + 0x28]
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
mov ebx, 0xfffffe00
and esp, ebx
mov esi, esp
neg ebx
sub esp, ebx
push edx
push eax
push eax
push ebp
mov dl, pe_nt_image_headers32
xor ebx, ebx
call fcn.00411aa3
stosb byte es:[edi], al
mov bl, 2
call fcn.00411a81
jae 0x4119da
xor ecx, ecx
xor eax, eax
call fcn.00411a81
jae 0x411a0e
call fcn.00411a81
jae 0x411a1e
mov bl, 2
inc ecx
mov al, 0x10
call fcn.00411a81
adc al, al
jae 0x411a00
jne 0x411a77
stosb byte es:[edi], al
jmp 0x4119e2
call fcn.00411a93
sub ecx, ebx
jne 0x411a50
call fcn.00411a93
jmp 0x411a73
call fcn.00411aa3
shr eax, 1
rcl ecx, 1
jne 0x411a70
pop ebp
pop eax
pop eax
pop edx
mov esp, ebp
and esi, 0x1ff
je 0x411a44
sub esi, eax
push 1
push 0
push esi
push edx
call sub.KERNEL32.dll_SetFilePointer
sub edi, dword [ebp + 0x28]
mov esi, dword [ebp + 0x30]
mov dword [esi], edi
popal
ret 0x14
xchg ecx, eax
dec eax
shl eax, 8
call fcn.00411aa3
call fcn.00411a93
cmp eax, 0x7d00
jae 0x411a70
cmp ah, 5
jae 0x411a71
cmp eax, 0x7f
ja 0x411a72
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x411a0c

Function at 0x411aa3
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
test esi, 0x1ff
jne 0x411ade
sub esi, 0x200
pushal
push eax
mov ecx, esp
push 0
push ecx
push 0x200
push esi
push dword [esi - 4]
call sub.KERNEL32.dll_ReadFile
pop dword [esi - 8]
mov eax, dword [esi - 0xc]
mov cl, byte [esi]
rol dword [esi - 0xc], cl
mov ecx, pe_nt_image_headers32
xor dword [esi], eax
add esi, 4
loop 0x411ad6
popal
lodsb al, byte [esi]
ret

Function at 0x411c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, dword [sym.imp.msvcrt.dll__iob]
mov dword [ebp - 4], esi
lea esi, [ebp + 0xc]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], 0x412d20
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort