joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f101
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push 0x50
mov eax, 0x1002deb6
call fcn.1002b28b
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x54], eax
xor eax, eax
cmp word [ebp + 0x1c], ax
setne al
movzx eax, ax
push eax
push esi
call fcn.100070e7
pop ecx
pop ecx
test eax, eax
jne 0x1001f225
mov eax, dword [esi + 4]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], esi
inc dword [eax + 0x38]
inc dword [esi + 0x14]
and dword [ebp - 4], 0
xor eax, eax
mov ebx, dword [esi + 4]
mov word [ebp - 0x4c], ax
lea eax, [esi + 0xc]
mov dword [ebp - 0x48], eax
xor eax, eax
push 4
pop ecx
mov word [ebp - 0x3c], ax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor eax, eax
push 0
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x54]
push 0x7fffffff
push eax
mov dword [ebp - 0x50], 0x50525350
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0x52535043
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0x52535048
mov dword [ebp - 0x28], eax
call fcn.100070e7
mov dword [ebp - 0x24], eax
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x20], 0x55524544
cmp byte [0x1003ce0b], 0
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
jne 0x1001f1c9
cmp byte [0x1003ce0a], 0
je 0x1001f1fd
push ebx
push str.__lx__PDFXSendOrSave_kPDFXPushResponse_
mov esi, 0x1003d238
push esi
call fcn.100070e7
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x1001f1ed
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x1001f1fd
push esi
call fcn.10005ee0
pop ecx
xor eax, eax
cmp word [ebp + 0x1c], ax
push 8
pop ecx
cmovne eax, ecx
push eax
push 4
lea eax, [ebp - 0x50]
push eax
push ebx
call fcn.1001ed91
add esp, 0x10
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.100070e7
mov eax, esi
call fcn.1002b235
ret
Function at 0x10022546
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x440
mov eax, 0x1002dfaf
call fcn.1002b2f9
mov eax, dword [ebp + 8]
mov esi, 0x208
mov dword [ebp - 0x438], eax
xor edi, edi
mov dword [ebp - 0x440], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x424]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x21c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x434], 0x104
lea eax, [ebp - 0x428]
xorps xmm0, xmm0
movsd qword [ebp - 0x430], xmm0
push eax
push 0x20019
push edi
push 0x1003344c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10022765
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
mov ebx, edi
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
jmp 0x10022652
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtof]
fstp qword [ebp - 0x44c]
movsd xmm0, qword [ebp - 0x44c]
comisd xmm0, xmmword [0x10033728]
pop ecx
jbe 0x1002263e
comisd xmm0, xmmword [ebp - 0x430]
jbe 0x1002263e
lea eax, [ebp - 0x21c]
movsd qword [ebp - 0x430], xmm0
push eax
lea eax, [ebp - 0x424]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
inc ebx
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x100225ea
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
jne 0x10022765
push str.ClientUserInterface
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
mov dword [esp], str.SoftwareMicrosoftSoftGrid_
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
xor ecx, ecx
mov dword [ebp - 0x42c], edi
push 2
pop edx
lea ebx, [eax + 0x105]
mov dword [ebp - 4], edi
add ebx, esi
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100070e7
mov esi, eax
mov dword [ebp - 0x42c], esi
pop ecx
pop ecx
test esi, esi
je 0x10022765
push ebx
push edi
push esi
call fcn.100070e7
push str.SoftwareMicrosoftSoftGrid_
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea eax, [ebp - 0x424]
push eax
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push str.ClientUserInterface
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x30
lea eax, [ebp - 0x428]
push eax
push 0x20019
push edi
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002275e
push dword [ebp - 0x438]
push str.LaunchCommand
push dword [ebp - 0x428]
call fcn.1002279d
add esp, 0xc
push dword [ebp - 0x43c]
push str.DDELaunchCommand
push dword [ebp - 0x428]
call fcn.1002279d
add esp, 0xc
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.1002b561
pop ecx
call fcn.1002b246
ret
Function at 0x1002279d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1002dfd9
call fcn.1002b2c2
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100228e2
cmp dword [ebp - 0x18], 1
jne 0x100228e2
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 4], ebx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100070e7
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
test esi, esi
je 0x100228e2
push dword [ebp - 0x14]
push ebx
push esi
call fcn.100070e7
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax*2 - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100228d7
cmp dword [ebp - 0x18], 1
jne 0x100228d7
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x14], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100070e7
mov dword [edi], eax
pop ecx
test eax, eax
je 0x100228d7
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.100070e7
lea eax, [ebp - 0x20]
push eax
push 0x10033448
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x100228bb
push ebx
call fcn.100070e7
pop ecx
test al, al
je 0x100228bb
mov eax, dword [ebp - 0x14]
push ebx
inc eax
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x100228d7
push dword [edi]
call fcn.1002b561
and dword [edi], 0
pop ecx
jmp 0x100228d7
test esi, esi
je 0x100228e2
push esi
call fcn.1002b561
pop ecx
call fcn.1002b220
ret

Function at 0x10023089
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x100331a4
xor esi, esi
call fcn.100070e7
pop ecx
test eax, eax
jne 0x100230aa
push 0x100331bc
call fcn.100070e7
pop ecx
test eax, eax
je 0x100230ad
xor esi, esi
inc esi
cmp byte [0x1003ce0b], 0
jne 0x100230bf
cmp byte [0x1003ce0a], 0
je 0x100230f5
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x1003d650
push edi
call fcn.100070e7
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x100230e4
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100230f4
push edi
call fcn.10005ee0
pop ecx
pop edi
mov eax, esi
pop esi
ret
Function at 0x1002549d
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002551b
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002551b
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003ce0b], 0
jne 0x100254df
cmp byte [0x1003ce0a], 0
je 0x10025516
movzx eax, bl
mov esi, 0x1003e1b8
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.100070e7
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10025506
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10025516
push esi
call fcn.10005ee0
pop ecx
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003ce0b], 0
jne 0x1002552d
cmp byte [0x1003ce0a], 0
je 0x1002555f
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e1b8
push esi
call fcn.100070e7
cmp byte [0x1003ce0a], 0
pop ecx
pop ecx
je 0x1002554f
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x1002555f
push esi
call fcn.10005ee0
pop ecx
mov al, 1
pop esi
ret
Function at 0x10028ddc
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10028df9
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003ce0b], 0
jne 0x10028e0f
cmp byte [0x1003ce0a], 0
je 0x10028f4e
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e608
push edi
call fcn.100070e7
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028e35
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028e4e
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028e57
cmp byte [0x1003ce0a], 0
je 0x10028e77
push 4
push str.sizeof_Uns32____d
push edi
call fcn.100070e7
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028e77
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028e90
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028e99
cmp byte [0x1003ce0a], 0
je 0x10028eb9
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.100070e7
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028eb9
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028ed2
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028edb
cmp byte [0x1003ce0a], 0
je 0x10028efb
push 4
push str.sizeof_Handle32____d
push edi
call fcn.100070e7
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028efb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028f14
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028f1d
cmp byte [0x1003ce0a], 0
je 0x10028f3d
push 4
push str.sizeof_void____d
push edi
call fcn.100070e7
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028f3d
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028f4d
push edi
call fcn.10005ee0
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x10028fdd
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002e2c3
call fcn.1002b28b
cmp byte [0x1003ce0b], 0
mov ebx, 0x1003e608
mov edi, dword [ebp + 8]
jne 0x10029008
mov al, byte [0x1003ce0a]
test al, al
jne 0x10029008
lea esi, [edi + 4]
jmp 0x1002901f
lea esi, [edi + 4]
push esi
push str.ASM_Release__s
push ebx
call fcn.100070e7
mov al, byte [0x1003ce0a]
add esp, 0xc
test al, al
je 0x1002902a
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x1002903a
push ebx
call fcn.10005ee0
pop ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.100070e7
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028bc
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x1002906d
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.10003172
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002b235
ret
Function at 0x10029083
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e2f7
call fcn.1002b28b
cmp byte [0x1003ce0b], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x100290b0
cmp byte [0x1003ce0a], 0
je 0x100290ff
call fcn.100070e7
test al, al
mov edx, 0x1002fbdc
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e608
call fcn.100070e7
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x100290eb
push 0x1003e608
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100290ff
push 0x1003e608
call fcn.10005ee0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.100070e7
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028bc
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.10003172
test ebx, ebx
jne 0x1002917d
cmp byte [0x1003ce0b], bl
jne 0x10029149
cmp byte [0x1003ce0a], bl
je 0x100291f1
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e608
push ebx
call fcn.100070e7
cmp byte [0x1003ce0a], 0
pop ecx
pop ecx
je 0x1002916b
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100291f1
push ebx
call fcn.10005ee0
pop ecx
jmp 0x100291f1
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x100291ac
cmp byte [0x1003ce0b], al
jne 0x100291a5
cmp byte [0x1003ce0a], al
je 0x100291f1
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x1002914e
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x100291e1
cmp byte [0x1003ce0b], al
jne 0x100291d7
cmp byte [0x1003ce0a], al
je 0x100291f1
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x1002914e
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b235
ret
Function at 0x406c81
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x406cbf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406c95
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x406c90
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406cec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406ccd
not eax
pop ebp
ret 0xc

Function at 0x10013a4
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x248]
mov edi, 0xfffff758
and eax, edi
or eax, dword [ebp + 8]
push eax
lea eax, [esi + 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10013e4
mov eax, dword [esi + 0x248]
and eax, edi
or eax, dword [ebp + 8]
mov dword [esi + 0x248], eax
mov al, 1
jmp 0x10013f5
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10013f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
xor al, al
pop edi
pop esi
pop ebp
ret 8
Function at 0x403f2c
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
xor eax, eax
mov edx, dword [eax*4 + 0x8728ec]
movsx ecx, byte [edx + 0x2a8]
test ecx, ecx
jne 0x40412e
inc eax
cmp eax, 4
jl 0x403f31
je 0x404101
cmp dword [0x872ed0], 0
jl 0x4040fd
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebp
mov esi, eax
mov edi, dword [esi*4 + 0x8728ec]
cmp dword [edi + 0x2a4], 0
jne 0x403fb2
xor ebp, ebp
mov dword [edi + 0x2ac], ebp
mov dword [edi + 0x2b0], ebp
mov edx, 1
mov byte [edi + 0x2b4], dl
mov byte [edi + 0x2b5], dl
jmp 0x4040e4
mov edx, dword [esp + 0x18]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
lea ebx, [esp + 0x10]
push ebx
push dword [edi + 0x2a4]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ebx, dword [esi*4 + 0x8728ec]
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x2ac], ecx
mov edx, dword [esp + 0x14]
mov dword [ebx + 0x2b0], edx
test esi, esi
jne 0x404046
mov edx, dword [0x8723c0]
sub ecx, edx
mov dword [ebx + 0x2ac], ecx
mov ecx, dword [0x8723c4]
sub dword [ebx + 0x2b0], ecx
mov ecx, dword [0x872514]
test ecx, ecx
je 0x404029
mov eax, dword [ebx + 0x2ac]
imul eax, dword [ebx + 0xc]
cdq
idiv ecx
mov dword [ebx + 0x2ac], eax
mov ecx, dword [0x872518]
test ecx, ecx
je 0x404046
mov eax, dword [ebx + 0x2b0]
imul eax, dword [ebx + 0x10]
cdq
idiv ecx
mov dword [ebx + 0x2b0], eax
xor edx, edx
mov byte [ebx + 0x2b4], dl
mov byte [ebx + 0x2b5], dl
mov edx, dword [ebx + 0x2ac]
test edx, edx
jl 0x404072
mov ecx, dword [ebx + 0x2b0]
test ecx, ecx
jl 0x404072
cmp edx, dword [ebx + 0xc]
jge 0x404072
cmp ecx, dword [ebx + 0x10]
jl 0x4040e4
mov byte [ebx + 0x2b4], 1
mov ecx, dword [0x8723c0]
mov ebp, dword [0x8723c4]
mov edi, dword [0x872514]
test edi, edi
je 0x40409c
mov edx, dword [ebx + 0xc]
imul ecx, edx
mov eax, ecx
cdq
idiv edi
mov ecx, eax
mov edi, dword [0x872518]
test edi, edi
je 0x4040b3
mov edx, dword [ebx + 0x10]
imul ebp, edx
mov eax, ebp
cdq
idiv edi
mov ebp, eax
mov edx, dword [ebx + 0x2ac]
mov edi, ecx
neg edi
cmp edx, edi
jl 0x4040dd
mov eax, dword [ebx + 0x2b0]
mov edi, ebp
neg edi
cmp eax, edi
jl 0x4040dd
add ecx, dword [ebx + 0xc]
cmp edx, ecx
jge 0x4040dd
add ebp, dword [ebx + 0x10]
cmp eax, ebp
jl 0x4040e4
mov byte [ebx + 0x2b5], 1
inc esi
cmp esi, 4
jl 0x403f7e
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edi, dword [esp + 4]
mov ebp, dword [esp]
add esp, 0x20
ret
mov dword [0x872ed0], 0xffffffff
push 0x400
push 0x6634c0
call dword [0x5b8560]
add esp, 8
push 0x6633c0
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x403f53
mov dword [0x872ed0], eax
push 0x6634c0
call dword [sym.imp.USER32.dll_GetKeyboardState]
movsx eax, byte [0x872644]
test eax, eax
jle 0x403f53
cmp eax, 1
jne 0x404159
mov byte [0x6634c1], 0x80
dec eax
mov byte [0x872644], al
jmp 0x403f53
Function at 0x40ce98
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push edi
push esi
push ebp
push ebx
push esi
mov dword [esp], edx
mov eax, dword [eax]
inc dword [0x8728a4]
mov edi, ecx
xor esi, esi
xor esi, ecx
cmp ecx, 4
jl 0x40ced9
imul ebp, dword [edx], 0x5bd1e995
mov ebx, ebp
shr ebx, 0x18
xor ebp, ebx
imul ebx, ebp, 0x5bd1e995
imul esi, esi, 0x5bd1e995
xor esi, ebx
add edx, 4
add edi, 0xfffffffc
cmp edi, 4
jge 0x40ceb3
cmp edi, 3
je 0x40ceea
cmp edi, 2
je 0x40cef3
cmp edi, 1
je 0x40cefc
jmp 0x40cf07
movzx edi, byte [edx + 2]
shl edi, 0x10
xor esi, edi
movzx edi, byte [edx + 1]
shl edi, 8
xor esi, edi
movzx edx, byte [edx]
xor esi, edx
imul esi, esi, 0x5bd1e995
mov edx, esi
shr edx, 0xd
xor esi, edx
imul esi, esi, 0x5bd1e995
mov edi, esi
shr edi, 0xf
xor esi, edi
and esi, 0x7fffffff
add esi, 0x80000000
test eax, eax
je 0x40cf6a
mov edi, dword [0x8728a0]
mov ebx, eax
mov ebp, ecx
inc edi
mov dword [0x8728a0], edi
cmp esi, dword [ebx + 0x1c]
jne 0x40cf61
cmp ebp, dword [ebx + 0x18]
jne 0x40cf5b
push ebp
mov edx, dword [esp + 4]
push edx
push dword [ebx + 0x14]
call fcn.0046f6c0
add esp, 0xc
test eax, eax
je 0x40cf70
inc dword [0x87289c]
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jne 0x40cf35
mov eax, ebx
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret
mov eax, ebx
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x410ee0
Capabilities:
Get common file path

Disassembly:
push edi
push esi
push ebx
sub esp, 0x108
push 0x105
push 0x660a80
push 0
call dword [0x57725c]
mov eax, 0x660a80
call fcn.00464efc
lea edx, [esp + 4]
xor eax, eax
push eax
push eax
push edx
push 0x660de0
push 0x660a80
call fcn.0046fe67
add esp, 0x14
mov edi, 0x660de0
lea edx, [esp + 4]
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x410f33
mov eax, 0x660de0
call fcn.00464efc
mov edx, 0x660de0
movsx eax, byte [edx]
test eax, eax
je 0x410f7a
movzx esi, al
movzx ecx, byte [esi + 0x59b0a0]
inc ecx
movsx edi, cl
cmp edi, 2
je 0x4110b6
cmp eax, 0x2f
jne 0x410f72
mov byte [edx], 0x5c
inc edx
movsx eax, byte [edx]
test eax, eax
jne 0x410f53
mov edi, 0x660de0
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x410f91
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x410f89
mov ecx, eax
test ecx, ecx
jle 0x410fc5
xor edx, edx
lea eax, [ecx - 1]
movzx esi, byte [edx + 0x660de0]
movzx ebx, byte [esi + 0x59b0a0]
inc ebx
movsx edi, bl
add edx, edi
cmp edx, eax
jne 0x410fc1
cmp byte [edx + 0x660de0], 0x5c
je 0x41109f
cmp edx, ecx
jl 0x410f9c
xor eax, eax
test eax, eax
jne 0x410fe9
mov edi, 0x660de0
mov edx, 0x878338
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x410fdf
mov esi, 0x660ba0
mov edi, 0x660a80
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x410ff3
mov edx, 0x660ba0
movsx eax, byte [edx]
test eax, eax
je 0x411030
movzx esi, al
movzx ecx, byte [esi + 0x59b0a0]
inc ecx
movsx edi, cl
cmp edi, 2
je 0x4110ae
cmp eax, 0x5c
jne 0x411028
mov byte [edx], 0x3a
inc edx
movsx eax, byte [edx]
test eax, eax
jne 0x411009
mov esi, 0x660cc0
mov edi, 0x660de0
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x41103a
mov edx, 0x660cc0
movsx eax, byte [edx]
test eax, eax
je 0x411073
movzx esi, al
movzx ecx, byte [esi + 0x59b0a0]
inc ecx
movsx edi, cl
cmp edi, 2
je 0x4110a9
cmp eax, 0x5c
jne 0x41106b
mov byte [edx], 0x3a
inc edx
movsx eax, byte [edx]
test eax, eax
jne 0x411050
xor eax, eax
push eax
push 0x1a
push 0x661020
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
xor eax, eax
push eax
push 5
push 0x661140
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 0x108
pop ebx
pop esi
pop edi
ret
mov eax, 1
jmp 0x410fc7
add edx, 2
jmp 0x41106c
add edx, 2
jmp 0x411029
add edx, 2
jmp 0x410f73