joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403084
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x414044]
jne 0x40308e
repz ret
jmp fcn.00403d51

Function at 0x408c95
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404215
and dword [ebp - 4], 0
cmp dword [0x4159dc], 0
mov ebx, eax
jne 0x408d46
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408df7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408df7
push eax
call fcn.004041a3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4159dc], eax
call esi
push eax
call fcn.004041a3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4159e0], eax
call esi
push eax
call fcn.004041a3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4159e4], eax
call esi
push eax
call fcn.004041a3
pop ecx
mov dword [0x4159ec], eax
test eax, eax
je 0x408d46
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004041a3
pop ecx
mov dword [0x4159e8], eax
mov eax, dword [0x4159e8]
cmp eax, ebx
je 0x408d9e
cmp dword [0x4159ec], ebx
je 0x408d9e
push eax
call fcn.0040421e
push dword [0x4159ec]
mov esi, eax
call fcn.0040421e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408d9e
test edi, edi
je 0x408d9e
call esi
test eax, eax
je 0x408d95
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408d95
test byte [ebp - 0xc], 1
jne 0x408d9e
or dword [ebp + 0x10], 0x200000
jmp 0x408dd7
mov eax, dword [0x4159e0]
cmp eax, ebx
je 0x408dd7
push eax
call fcn.0040421e
pop ecx
test eax, eax
je 0x408dd7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408dd7
mov eax, dword [0x4159e4]
cmp eax, ebx
je 0x408dd7
push eax
call fcn.0040421e
pop ecx
test eax, eax
je 0x408dd7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4159dc]
call fcn.0040421e
pop ecx
test eax, eax
je 0x408df7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408df9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cd70
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x40cd90
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x1011c58
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 4
pop eax
call fcn.0100e350
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1011cbe
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x1017160]
mov esi, dword [ebp - 0x40]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
lea edx, [esi - 1]
and ecx, 0x103
not edx
and edx, ebx
inc ecx
sub edx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff1
add eax, 0x11
imul eax, esi
add eax, edi
cmp edx, eax
jae 0x1011cc2
xor eax, eax
jmp 0x1011ccf
lea eax, [ebp - 4]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x50]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1012a89
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x1014b48]
and dword [ebp - 0xa8], 0
cmp dword [0x10156c8], 0xfffffffe
mov dword [ebp - 4], eax
mov dword [ebp - 0xb0], 0xc
jne 0x1012bac
and dword [0x10156c8], 0
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1012bac
cmp dword [ebp - 0x94], 1
jne 0x1012bac
cmp dword [ebp - 0xa0], 4
jne 0x1012bac
cmp dword [ebp - 0x9c], 0xa
jae 0x1012bac
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1012bac
lea eax, [ebp - 0xac]
push eax
push 0x20019
push 0
push 0x100288c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1012bac
push edi
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xb4]
push eax
push 0
push 0x1001443
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xac]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x1012bac
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.01012965
test eax, eax
je 0x1012bac
and dword [ebp - 0xa8], 0x3ff
cmp dword [ebp - 0xa8], 1
je 0x1012ba2
cmp dword [ebp - 0xa8], 0xd
jne 0x1012bac
mov dword [0x10156c8], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x10156c8]
call fcn.0100c759
leave
ret

Function at 0x5d8aa7
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, 0x5d87dc
mov esi, 0xe18f021f
call fcn.005d8ad7
sub eax, eax
dec esi
xor dword [edi], edx
dec eax
add edi, 2
mov eax, eax
mov eax, esi
cmp edi, ebx
jl fcn.005d8aa7
mov esi, 0x43004797
mov eax, 0xf8649d7f
ret
Function at 0x401c70
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x401cbb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401cb4
test esi, esi
je 0x401cb4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401c90
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401ea0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401ef0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401fc4
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x401f2e
cmp eax, 4
jne 0x401f50
test esi, esi
je 0x401f42
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x401f34
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x401f8f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x401f81
cmp ecx, 0x40
je 0x401f42
cmp ecx, 4
je 0x401f42
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401ea0
lea esi, [esi]

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401470
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], edx
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movq qword [esi + 0x10], xmm0
mov dword [esi + 0x18], 0
mov eax, dword [0x4a05c4]
test eax, eax
je 0x4014a4
cmp dword [eax + 0x1fc], 0
jne 0x401641
push ebx
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
push 0
push 0
push 0
push 0
push esi
mov dword [0x4a0418], 0
call ebx
test eax, eax
je 0x401622
push edi
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
nop
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4015da
mov ecx, dword [0x4a053c]
xor ebx, ebx
test ecx, ecx
je 0x401523
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
test eax, eax
je 0x401523
nop dword [eax + eax]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.MMFS2.dll_Ordinal_536]
push esi
push eax
call edi
test eax, eax
jne 0x4015d4
cmp dword [ebp - 4], ebx
je 0x401523
mov ecx, dword [0x4a053c]
jmp 0x401500
mov eax, dword [0x4a05c4]
test eax, eax
je 0x4015c6
mov ecx, 0x4000
test word [eax + 0x16], cx
je 0x4015c6
push dword [0x4a0598]
call dword [sym.imp.MMFS2.dll_Ordinal_19]
test eax, eax
je 0x401561
push esi
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
test eax, eax
mov eax, 1
cmovne ebx, eax
mov eax, dword [esi + 4]
cmp eax, 0x100
je 0x401572
cmp eax, 0x104
jne 0x4015c2
mov edi, dword [esi + 8]
cmp edi, 0x10
je 0x4015c2
cmp edi, 0x11
je 0x4015c2
mov ecx, dword [0x4a05c4]
test ecx, ecx
je 0x4015c2
mov ecx, dword [ecx + 0xb4]
test ecx, ecx
je 0x4015c2
cmp eax, 0x104
je 0x4015a9
mov eax, 0x2000
test word [esi + 0xe], ax
jne 0x4015a9
xor edx, edx
jmp 0x4015ae
mov edx, 1
push ecx
mov ecx, dword [0x4a05a0]
push edi
call fcn.00457780
add esp, 8
test eax, eax
jne 0x4015d4
test ebx, ebx
jne 0x4015d4
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
mov eax, dword [ebp - 8]
test eax, eax
je 0x401608
test al, 1
je 0x4015ee
cmp dword [esi + 4], 0x111
je 0x401621
test al, 2
je 0x4015fb
cmp dword [esi + 4], 0x201
je 0x401621
test al, 4
je 0x401608
cmp dword [esi + 4], 0x202
je 0x401621
push 0
push 0
push 0
push 0
push esi
call ebx
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x4014d0
pop edi
push 0
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x4a0420
push 0
push 0xb
push 0
call dword [sym.imp.MMFS2.dll_Ordinal_31]
mov dword [0x4a0418], eax
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409ce0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 2
push 0x104
mov esi, ecx
call fcn.004643e4
mov edi, eax
add esp, 8
test edi, edi
je 0x409d26
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [ebp + 8]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push edi
mov esi, eax
call fcn.004643fa
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40b1c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov edx, ebx
push esi
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40b1d0
sub edx, ecx
sar edx, 1
push 2
lea eax, [edx + 4]
push eax
call fcn.004643e4
mov esi, eax
add esp, 8
mov dword [ebp - 4], esi
test esi, esi
jne 0x40b1ff
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 2
push 0x104
call fcn.004643e4
mov edi, eax
add esp, 8
test edi, edi
jne 0x40b228
push esi
call fcn.004643fa
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor esi, esi
sub ecx, ebx
nop
movzx eax, word [ebx]
lea ebx, [ebx + 2]
mov word [ecx + ebx - 2], ax
test ax, ax
jne 0x40b230
mov ebx, dword [ebp - 4]
push 0x5c
push ebx
call fcn.00461e35
add esp, 8
test eax, eax
je 0x40b258
xor ecx, ecx
mov word [eax + 2], cx
cmp word [ebx], 0x5c
jne 0x40b280
cmp word [ebx + 2], 0x5c
jne 0x40b280
lea eax, [ebx + 4]
push 0x5c
push eax
call fcn.00461ed7
add esp, 8
test eax, eax
je 0x40b323
lea ebx, [eax + 2]
jmp 0x40b291
cmp word [ebx + 2], 0x3a
jne 0x40b291
cmp word [ebx + 4], 0x5c
jne 0x40b291
add ebx, 6
push 0x5c
push ebx
call fcn.00461ed7
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40b320
mov ecx, dword [ebp - 4]
mov eax, ebx
sub eax, ecx
sar eax, 1
push eax
push ecx
push edi
call fcn.0046596e
push edi
call fcn.00465b3c
add esp, 0x10
test eax, eax
je 0x40b2e7
push edi
call fcn.00465b47
add esp, 4
test eax, eax
je 0x40b2d4
mov esi, 1
jmp 0x40b2e7
push edi
call fcn.00465b3c
add esp, 4
test eax, eax
mov eax, 1
cmovne esi, eax
lea eax, [ebx + 2]
mov dword [ebp - 8], ebx
push 0x5c
push eax
call fcn.00461ed7
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40b305
mov ecx, dword [ebp - 8]
test esi, esi
je 0x40b2a5
mov ebx, dword [ebp - 4]
push edi
call fcn.004643fa
push ebx
call fcn.004643fa
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 4]
mov edx, edi
mov ecx, ebx
sub edx, ebx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x40b330
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b345
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x40b368
cmp word [edi + ecx*2 - 2], 0x5c
jne 0x40b368
xor eax, eax
mov word [edi + ecx*2 - 2], ax
push edi
call fcn.00465b3c
add esp, 4
test eax, eax
je 0x40b308
push edi
call fcn.00465b47
add esp, 4
test eax, eax
je 0x40b38c
mov esi, 1
jmp 0x40b308
push edi
call fcn.00465b3c
add esp, 4
mov ecx, 1
test eax, eax
cmovne esi, ecx
jmp 0x40b308
Function at 0x40b4b0
Capabilities:
Enumerate pe sections
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
mov eax, dword [0x49e014]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, ecx
push edi
push 0
push 0
push 0
push ebx
call esi
push 0
lea eax, [esp + 0x24]
push eax
push 0x40
lea eax, [esp + 0x3c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40b515
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00460901
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x40b4fd
cmp eax, 0x40
jne 0x40b4fd
mov eax, 0x5a4d
cmp ax, word [esp + 0x30]
jne 0x40b4fd
push 0
push 0
push dword [esp + 0x74]
push ebx
call esi
push 1
xorps xmm0, xmm0
lea eax, [esp + 0x14]
push eax
movlpd qword [esp + 0x28], xmm0
push dword [esp + 0x2c]
movlpd qword [esp + 0x1c], xmm0
push dword [esp + 0x2c]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x40b56c
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x6c]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cdq
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ecx
cmp esi, eax
jne 0x40b4fd
cmp ecx, edx
jne 0x40b4fd
push 0xf8
call fcn.00460912
add esp, 4
mov esi, eax
mov edx, esi
mov dword [esp + 0x20], esi
mov ecx, ebx
push 0xf8
call fcn.0040b3d0
add esp, 4
test eax, eax
je 0x40b5df
push 0xf8
push esi
call fcn.00460942
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00460901
mov esp, ebp
pop ebp
ret
movzx eax, word [esi + 6]
mov ecx, ebx
mov edi, dword [esi + 0x54]
mov dword [esp + 0x2c], eax
movzx eax, word [esi + 0x14]
cdq
add eax, dword [esp + 0x18]
adc edx, dword [esp + 0x1c]
add eax, 0x18
adc edx, 0
push edx
push eax
call fcn.0040b470
add esp, 8
mov ecx, ebx
call fcn.0040b430
mov ecx, eax
mov dword [esp + 0x10], edx
movzx eax, word [esi + 0x14]
cdq
add eax, dword [esp + 0x18]
adc edx, dword [esp + 0x1c]
add eax, 0x18
adc edx, 0
cmp ecx, eax
jne 0x40b68a
cmp dword [esp + 0x10], edx
jne 0x40b68a
xor esi, esi
cmp dword [esp + 0x2c], esi
jbe 0x40b662
nop dword [eax + eax]
push 0x28
lea edx, [esp + 0x78]
mov ecx, ebx
call fcn.0040b3d0
add esp, 4
test eax, eax
jne 0x40b662
add edi, dword [esp + 0x84]
inc esi
cmp esi, dword [esp + 0x2c]
jb 0x40b640
push 0xf8
push dword [esp + 0x24]
call fcn.00460942
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00460901
mov esp, ebp
pop ebp
ret
push 0xf8
push esi
call fcn.00460942
mov ecx, dword [esp + 0xa4]
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00460901
mov esp, ebp
pop ebp
ret
Function at 0x40db80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, dword [edi + 0xbc]
mov eax, dword [ecx + 0x14]
add esi, edi
mov edx, dword [edi + 0x1c]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0x18]
mov ecx, 1
mov dword [esi + 0xc], eax
mov eax, pe_nt_image_headers32
mov dword [esi + 0x10], 1
test word [edi + 0x94], ax
jne 0x40dbc6
mov dword [esi + 0x10], 0
xor ecx, ecx
mov dword [esi + 0x14], 0
lea eax, [edx + 0x3a]
mov ebx, dword [edi + 0x78]
test bl, 4
je 0x40dbdd
test byte [eax], 1
je 0x40dc07
and ebx, 0xfffffffb
mov dword [edi + 0x78], ebx
mov ebx, eax
mov ecx, dword [esi + 0x10]
or ecx, 0x200
mov dword [esi + 0x10], ecx
test byte [ebx], 2
je 0x40dc07
mov eax, dword [edx + 0x46]
or ecx, 0x400
mov dword [esi + 0x14], eax
mov eax, ebx
mov dword [esi + 0x10], ecx
test dword [edi + 0x78], 0x400
je 0x40dc19
or ecx, 0x4000
mov dword [esi + 0x10], ecx
test byte [eax], 4
je 0x40dc27
or ecx, 0x100
mov dword [esi + 0x10], ecx
mov eax, dword [ebp + 8]
mov ebx, 1
test byte [eax + 6], 2
je 0x40dc54
or ecx, 0x80
mov word [esi + 0x20], bx
mov dword [esi + 0x10], ecx
cmp word [edi + 0x18], 3
jne 0x40dc59
mov eax, 0x2000
or word [edi + 0x7c], ax
jmp 0x40dc59
or word [esi + 0x20], 0x20
mov ecx, dword [edx + 0x3c]
mov dword [esi + 0x18], ecx
mov eax, dword [edx + 0x40]
mov dword [esi + 0x1c], eax
cmp cx, 0xd
jne 0x40dcb8
mov ecx, dword [0x4a05c4]
movsx edx, word [edx]
cmp edx, dword [ecx + 0x194]
jge 0x40dcab
mov eax, dword [ecx + 0x198]
movzx eax, word [eax + edx*2]
mov dword [ecx + 0x1a0], eax
lea edx, [eax + eax*2]
shl edx, 4
add edx, dword [ecx + 0x400]
je 0x40dcab
mov ecx, dword [edx + 0x28]
test ecx, ecx
je 0x40dcab
mov edx, dword [edx + 0xc]
call fcn.0044b030
jmp 0x40dcad
xor eax, eax
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x40dcb8
mov word [esi + 0x18], ax
cmp dword [edi + 0xcc], 0
jne 0x40dcdd
or word [esi + 0x20], 2
mov eax, ebx
or dword [esi + 0x10], 8
mov ecx, dword [esi + 0x10]
movzx ecx, cx
pop edi
mov word [esi + 0x22], cx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [esi + 0x10]
pop edi
mov word [esi + 0x22], ax
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4262f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x49e014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4a07a8], 0
mov ecx, dword [0x4a05cc]
push edi
mov dword [ebp - 0x48], ecx
mov dword [ecx + 0x2c], 0
lea edi, [ecx + 0x2c]
mov dword [ebp - 0x44], edi
je 0x42645b
push ebx
push esi
xor esi, esi
xor edx, edx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], edx
mov eax, dword [ecx + 0x18]
xor ebx, ebx
mov ecx, dword [eax + 0x254]
movzx eax, word [edx + ecx]
test eax, eax
je 0x42643d
cmp eax, 4
jbe 0x4263a9
cmp eax, 5
jne 0x42643d
add esi, 0x16
lea edi, [ebx + 8]
add esi, ecx
nop dword [eax]
movzx eax, word [esi]
add ebx, ebx
cmp dword [0x4a07a8], 0
je 0x426399
cmp dword [0x4a0418], 0
je 0x426387
movzx eax, al
movzx eax, byte [eax + 0x4a0420]
shl ax, 8
jmp 0x42638e
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
test ax, ax
jns 0x426399
or ebx, 1
sub esi, 2
sub edi, 1
jne 0x426360
mov edi, dword [ebp - 0x44]
jmp 0x426435
lea esi, [eax - 1]
mov dword [ebp - 0x38], 0x34
lea eax, [ebp - 0x38]
mov dword [ebp - 0x34], 0x83
push eax
push esi
call dword [sym.imp.WINMM.dll_joyGetPosEx]
test eax, eax
jne 0x426435
mov edx, dword [ebp - 0x30]
shl esi, 5
mov eax, dword [esi + 0x4a0600]
sub edx, eax
mov ecx, dword [esi + 0x4a0604]
sub ecx, eax
mov eax, ecx
shr eax, 2
cmp edx, eax
ja 0x4263ef
mov ebx, 4
jmp 0x4263ff
lea eax, [ecx + ecx*2]
shr eax, 2
cmp edx, eax
mov eax, 8
cmovae ebx, eax
mov eax, dword [esi + 0x4a0608]
mov ecx, dword [esi + 0x4a060c]
mov edx, dword [ebp - 0x2c]
sub ecx, eax
sub edx, eax
mov eax, ecx
shr eax, 2
cmp edx, eax
ja 0x426420
or ebx, 1
jmp 0x42642d
lea eax, [ecx + ecx*2]
shr eax, 2
cmp edx, eax
jb 0x42642d
or ebx, 2
mov eax, dword [ebp - 0x18]
shl eax, 4
or ebx, eax
mov esi, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov byte [edi], bl
mov ecx, dword [ebp - 0x48]
add edx, 2
add esi, 0x10
mov dword [ebp - 0x3c], edx
inc edi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], edi
cmp edx, 8
jl 0x426330
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00460901
mov esp, ebp
pop ebp
ret