joyce8/EMBER2024-capa huggingface dataset:
Function at 0x570d04
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.00579d13
mov dword [esp + 0x28], 0
test esi, esi
jne 0x570d4a
xor eax, eax
jmp 0x570d4d
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.0057a348
lea eax, [edi + 0x7c]
test eax, eax
je 0x570d68
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0057a6ad
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x570da6
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0057a6ad
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.00579a2d
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0057a3c9
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5811de
Capabilities:
Authenticate hmac

Disassembly:
idiv byte [ecx]
dec edx
mov dl, 0xb8
and esi, dword [ecx - 0x80]
sar edx, 0x3e
xor byte [edx - 0x6c], bl
jecxz 0x5811ed
call dword [0x6408b9d0]
adc eax, 0x6408b9d0
mov dl, 0x99
inc esp
sbb cl, bl
inc edx
add eax, 0xf97961d
pushfd
test eax, 0xd75fc35c
and bx, si
outsb dx, byte [esi]
mov ch, 0xee
sub byte [ecx - 0xb598462], bl
ja 0x5811e1
xor al, 0x59
lodsb al, byte [esi]
mov ebx, 0xed0729aa
fild word [edx + edi*2 - 0x22]
sub bh, byte [ebx]
invalid
Function at 0x5bb1b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.005c41c3
mov dword [esp + 0x28], 0
test esi, esi
jne 0x5bb1fa
xor eax, eax
jmp 0x5bb1fd
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call int.005c47f8
lea eax, [edi + 0x7c]
test eax, eax
je 0x5bb218
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.005c4b5d
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x5bb256
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.005c4b5d
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.005c3edd
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005c4879
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c98a3
Capabilities:
Encode data using xor

Disassembly:
int 0x18
jge 0x5c98f5
aas
wait
pop ecx
add eax, ebx
sub eax, dword [ebx]
clc
xchg byte [ebx + 0x23], dh
shl dword [ebx - 0x13fcf9e5], cl
jg 0x5c9913
add esi, eax
mov al, byte [0xdd4db0ff]
pop esp
lahf
mov byte [esi + 0x4e588fa8], bl
mov dword [esi + edx*4 + 0x2e], 0xba9e4e0c
push esp
fstp xword [edi]
insb byte es:[edi], dx
lea ebp, [edx + 0xd]
loop 0x5c9925
invalid
mov al, byte [0x93d62f6a]
xchg ebx, eax
mov esp, 0xa543e0c3
jg 0x5c989f
push ebp
pop ebx
sub dword [ecx], ecx
mov al, 0xa9
xor ecx, dword [0xc8e0a139]
insd dword es:[edi], dx
mov dl, 0xec
cmc
fimul word [ebp + 0xa]
sub dword [esi + 0x79], eax
sbb al, 0x71
invalid
or ch, byte [ecx]
inc esi
jns 0x5c9916
jno 0x5c98c2
jne 0x5c98e6
call 0xb4d9a562
xchg ebx, eax
pushal
or al, 0x7d
mov ah, 0x93
out 0x4d, eax
mov bh, 0xa6
leave
mov eax, dword [0x413ee560]
adc dword [ebx], eax
fisubr dword [ebx + 0x22]
movups xmmword [eax + 0x3e1e964a], xmm7
adc dword [eax + 0x3e1e964a], edi
xchg esi, eax
push ds
cmc
cmc
inc ecx
dec edx
ja 0x5c98da
dec esp
mov al, byte [0x87fe8e89]
jae 0x5c995b
xor eax, 0xe856aa51
mov esi, 0x32612c87
xor dh, dl
dec esi
push ecx
stosb byte es:[edi], al
push esi
call 0x2ce4575c
popal
xor dh, byte [edx]
dec esi
out 0xe2, al
leave
inc eax
out dx, al
mov dh, 0xbc
inc esi
and eax, 0x7117a45f
pop ds
loopne 0x5c998d
dec bl
cmp ax, 0x14c3
add esi, 0xffffffd5
pop ss
lock or esp, dword [0x77553913]
xchg esp, ebx
shr ch, 1
mov dword [0xde46bc49], eax
jb 0x5c98fd
mov esp, 0x9d72de46
or ah, 0x3c
in al, 0x9e
cdq
adc eax, 0x4d08b839
in al, 0xf
ret 0x51a
out 0xa9, eax
ficom dword [ebp - 0x37]
ret

Function at 0x5d3945
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
in eax, dx
push cs
mov ch, byte [esi + esi*8 + 0x5b050513]
mov esi, dword [eax]
mov esp, 0x7dc8184c
movsd dword es:[edi], dword [esi]
dec edx
push ecx
in eax, 0x6b
loop 0x5d39d9
push 0xffffffffffffffaa
sub esp, ebx
lodsb al, byte [esi]
pop ecx
mov cl, 0xbc
sub al, 0xf3
mov ebx, 0x4df7f027
mov al, byte [0x950a19db]
sbb ah, byte [eax - 0x1ff69e21]
dec edx
sub byte [eax + 0x362ead0e], dh
adc al, bl
cmp byte [esi - 0x7c5bd24c], bh
dec ebx
clc
les edi, [esi]
int1
xor dl, ch
loop 0x5d39fb
dec byte [0x2fbe57ec]
ret 0xa51
pop esi
inc ecx
in al, dx
je 0x5d3a16
je 0x5d398f
fadd st(3), st(0)
dec ebx
sbb byte [ebx - 0xe], dl
dec esi
cwde
dec edi
inc esp
sbb byte [esi], 2
mov eax, 0xb6b154ed
add bh, byte [eax - 0x494eab13]
mov ecx, 0xf6e9a6af
dec ebp
mov edx, 0xcc653d2e
int3
mov ebx, 0x859073e6
mov dword [0x2f7ca1ec], eax
int3
scasd eax, dword es:[edi]
push ebp
mov al, byte [0x55bfa96]
lcall 0x6639, 0x53798573
mov byte [edi], 0x27
add eax, 0x7985739a
push ebx
cmp dword [esi - 0x3a], esp
pop es
daa
pop eax
daa
xor dword [edi + 0x3f206c0], eax
sbb eax, 0x13cca0d6
rcr byte [ebx + 0x3cec139], 0xd6
loopne 0x5d3a1c
jge 0x5d39ec
pop es
mov esi, 0xe348e00
cmpsd dword [esi], dword es:[edi]
and ebp, edx
aas
sub bl, byte [edi]
jmp 0x5d39fd
Function at 0x406490
Capabilities:
Set console window title

Disassembly:
call fcn.00406784
mov eax, dword [esp + 8]
push dword [eax]
call sub.KERNEL32.dll_SetConsoleTitleA
push 0xfffffffffffffff6
call sub.KERNEL32.dll_GetStdHandle
push eax
push 0x432210
push eax
call sub.KERNEL32.dll_GetConsoleMode
pop eax
mov edx, dword [0x432210]
and edx, 0xffffffbf
or edx, 0x80
push edx
push eax
call sub.KERNEL32.dll_SetConsoleMode
call sub.KERNEL32.dll_GetConsoleWindow
push 0
push eax
mov dword [0x432268], eax
movsx ecx, word [esp + 0xc]
movsx edx, word [esp + 0xe]
push 0x45
push 0
push 0
push edx
push ecx
push 0
push eax
call sub.USER32.dll_SetWindowPos
call sub.USER32.dll_GetSystemMenu
push 0
push 0xf000
push eax
push 0
push 0xf030
push eax
call sub.USER32.dll_DeleteMenu
call sub.USER32.dll_DeleteMenu
push 0xfffffffffffffff0
push dword [0x432268]
call sub.USER32.dll_GetWindowLongA
and eax, 0xfffeffff
push eax
push 0xfffffffffffffff0
push dword [0x432268]
call sub.USER32.dll_SetWindowLongA
call fcn.00408780
push 0xffffffffffffffff
push 0x406544
call sub.KERNEL32.dll_SetConsoleCtrlHandler
ret 8

Function at 0x4088c0
Capabilities:
Manipulate console buffer

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [0x506bb0]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
test eax, eax
je 0x4088f0
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
add esp, 0x18
pop ebx
ret 0xc
add esp, 0x18
pop ebx
jmp 0x40c0f0
push ebx
sub esp, 0x38
lea eax, [esp + 0x44]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
lea eax, [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 8], 0
call fcn.0040cd90
sub esp, 0x10
movzx ebx, word [esp + 0x44]
movzx eax, word [esp + 0x40]
mov dword [esp], 0
shl ebx, 0x10
or ebx, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x40c178
call fcn.00408d60
lea edx, [esp + 0x2c]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
lea edx, [esp + 0x2a]
mov dword [esp + 8], 1
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
sub esp, 0x14
movzx eax, word [esp + 0x2a]
add esp, 0x38
pop ebx
ret 0xc
call fcn.00408d60
lea edx, [esp + 0x2c]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
lea edx, [esp + 0x2a]
mov dword [esp + 8], 1
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
sub esp, 0x14
movzx eax, byte [esp + 0x2a]
add esp, 0x38
pop ebx
ret 0xc
Function at 0x4090a0
Capabilities:
Log keystrokes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
test dword [esp + 0x4c], 0x100
je 0x4090c3
mov ebx, edi
test bl, bl
je 0x4090f8
cmp si, 0x58
jbe 0x409130
mov eax, dword [esp + 0x50]
test eax, eax
je 0x4090e0
mov ebx, 0xffffffff
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
movzx ebx, al
test al, al
je 0x4090d1
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, esi
mov edx, 0x1c
xor eax, eax
jmp 0x409113
lea edx, [eax + eax*4]
movzx edx, word [edx + edx + 0x4355a0]
cmp cx, dx
je 0x4091e0
add eax, 1
cmp eax, 0xc
jne 0x409108
jmp 0x4090d1
movzx esi, si
movzx eax, ax
mov dword [esp + 4], 2
lea ecx, [esi*8 + 0x4352c0]
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx ebp, ax
sub esp, 8
mov dword [esp], ebp
mov ebx, ebp
call dword [sym.imp.msvcrt.dll_isupper]
mov dword [esp], ebp
test eax, eax
jne 0x4091c0
call dword [sym.imp.msvcrt.dll_islower]
mov ecx, eax
mov eax, ebp
test ecx, ecx
je 0x409181
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll_toupper]
test byte [esp + 0x4c], 3
je 0x4091cd
mov esi, dword [esp + 0x1c]
movzx ebx, word [esi + 6]
cmp ebx, 0xff
jle 0x4090c9
mov ecx, edi
movzx ecx, cl
cmp ecx, ebp
je 0x4091ad
cmp eax, ecx
jne 0x4090c9
or bl, 0xff
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.msvcrt.dll_tolower]
test byte [esp + 0x4c], 3
jne 0x409188
test byte [esp + 0x4c], 0xc
je 0x409220
mov esi, dword [esp + 0x1c]
movzx ebx, word [esi + 4]
jmp 0x409190
lea eax, [eax + eax*4]
lea eax, [eax + eax + 0x4355a0]
test byte [esp + 0x4c], 3
jne 0x409240
test byte [esp + 0x4c], 0xc
je 0x409260
movzx ebx, word [eax + 6]
xor eax, eax
test ebx, ebx
setne al
test eax, eax
je 0x4090d1
cmp ebx, 0xff
jle 0x4090d6
or bl, 0xff
jmp 0x4091b0
test byte [esp + 0x4c], 0x10
jne 0x409250
mov ecx, edi
test cl, cl
jne 0x409190
movzx ebx, word [esi*8 + 0x4352c0]
jmp 0x409190
movzx ebx, word [eax + 8]
xor eax, eax
test ebx, ebx
setne al
jmp 0x409203
mov esi, dword [esp + 0x1c]
movzx ebx, word [esi + 2]
jmp 0x409190
test byte [esp + 0x4c], 0x10
je 0x409274
movzx ebx, word [eax + 4]
xor eax, eax
test ebx, ebx
setne al
jmp 0x409203
movzx ebx, word [eax + 2]
jmp 0x40920b
Function at 0x409280
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x38
mov edx, dword [ebx]
mov eax, dword [eax + 0xc]
test edx, edx
jne 0x409340
test al, 0x1c
jne 0x40929f
test al, 3
jne 0x409332
mov ebx, dword [0x4fd048]
test ebx, ebx
je 0x409332
movsx eax, bl
mov dword [esp], eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
sub esp, 4
movzx ecx, al
cwde
mov dword [esp + 0x28], 0
mov edx, eax
mov byte [esp + 0x2a], bl
mov ebx, eax
sar edx, 4
sar ebx, 6
and edx, 0x10
sar eax, 9
mov dword [esp], ecx
and ebx, 8
and eax, 2
mov dword [esp + 0x24], 0
or edx, ebx
mov word [esp + 0x26], cx
or eax, edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
sub esp, 8
mov word [esp + 0x28], ax
movzx eax, byte [0x4fd048]
lea edx, [esp + 0x20]
call fcn.00408f70
mov dword [0x4fd048], 0
add esp, 0x38
pop ebx
ret
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 6]
mov dword [esp + 8], eax
movzx eax, word [ebx + 8]
mov dword [esp + 4], eax
movsx eax, byte [ebx + 0xa]
mov dword [esp], eax
call fcn.004090a0
mov edx, dword [ebx + 0xc]
test dl, 0x1c
je 0x40938f
cmp eax, 0xffffffff
je 0x40929f
mov dword [0x4fd048], 0
mov edx, ebx
call fcn.00408f70
add esp, 0x38
pop ebx
ret
and dl, 3
je 0x409370
movzx edx, word [ebx + 6]
lea ecx, [edx - 0x60]
cmp cx, 9
ja 0x4093c4
mov ecx, dword [ebx]
test ecx, ecx
je 0x4093ba
mov ecx, dword [0x4fd048]
lea ecx, [ecx + ecx*4]
lea edx, [edx + ecx*2 - 0x60]
mov dword [0x4fd048], edx
cmp eax, 0xffffffff
jne 0x409383
jmp 0x409332
cmp eax, 0xffffffff
jne 0x409379
jmp 0x409332

Function at 0x4096f0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x48]
mov esi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x4c]
test ebx, ebx
js 0x409790
test ebp, ebp
js 0x409780
shl ebp, 0x10
movzx ebx, bx
or ebx, ebp
test edi, edi
js 0x40975a
mov dword [esp], 0
lea ebp, [esp + 0x18]
call fcn.00408d60
mov dword [esp + 4], ebp
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
xor eax, eax
sub esp, 8
test edi, edi
setne al
mov dword [esp + 4], ebp
mov dword [esp + 0x1c], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [0x50ac4c], 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
sub esp, 8
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call fcn.004113c0
mov ebp, eax
jmp 0x409713
mov dword [esp], esi
call fcn.00408e50
mov ebx, eax
jmp 0x40970f
Function at 0x414720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov eax, 0x1018
push edi
push esi
push ebx
call fcn.004230d8
sub esp, eax
mov ebx, dword [esp + 0x102c]
mov eax, dword [esp + 0x1034]
mov byte [esp + 0xd], 1
lea ebp, [esp + 0x1019]
mov ecx, dword [esp + 0x1038]
lea edx, [ebx + 1]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 1]
movzx ebx, byte [ebx]
shl edx, 8
and dx, 0xf00
mov esi, edx
mov edx, dword [esp + 0x1030]
or esi, ebx
lea edi, [edx - 1]
mov ebx, esi
mov edx, esi
mov word [esp + 0x12], si
mov byte [eax], bl
mov ebx, 0x100
mov byte [esp + 0x11], dl
lea edx, [eax + 1]
mov eax, dword [ecx]
mov dword [esp + 4], edi
add eax, edx
mov dword [ecx], 1
mov dword [esp + 0x14], eax
mov word [esp + 0xe], bx
test edi, edi
jle 0x4148a0
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
sub ebx, 1
cmp byte [esp + 0xd], 0
movzx edi, byte [esi]
movzx eax, byte [esi + 1]
je 0x4148b8
add esi, 2
sub dword [esp + 4], 2
mov dword [esp + 8], esi
movzx esi, al
mov eax, edi
shr al, 4
shl esi, 4
movzx edi, al
or esi, edi
xor byte [esp + 0xd], 1
cmp si, 0xfff
je 0x41494b
cmp si, word [esp + 0xe]
jb 0x4148e0
movzx eax, byte [esp + 0x11]
movzx ebx, word [esp + 0x12]
mov byte [esp + 0x19], al
lea eax, [esp + 0x1a]
jmp 0x414834
lea ebx, [ebx + ebx*2]
add eax, 1
lea edi, [ebx + ebx + 0x50ac60]
movzx ebx, byte [edi + 4]
mov byte [eax - 1], bl
movzx ebx, word [edi + 2]
cmp eax, ebp
je 0x4148a0
cmp ebx, 0xff
jg 0x414818
mov byte [esp + 0x11], bl
mov byte [eax], bl
mov edi, dword [esp + 0x14]
cmp edi, edx
jbe 0x4148a0
mov ebx, edx
sub ebx, edi
lea edi, [esp + 0x19]
add ebx, eax
mov dword [esp], ebx
jmp 0x414865
cmp dword [esp], eax
je 0x4148a0
movzx ebx, byte [eax]
sub eax, 1
add edx, 1
mov byte [edx - 1], bl
add dword [ecx], 1
cmp eax, edi
jae 0x414860
movzx edi, word [esp + 0xe]
cmp di, 0xffe
jbe 0x414920
mov eax, dword [esp + 4]
test eax, eax
jle 0x4148a0
mov word [esp + 0x12], si
jmp 0x4147ab
mov eax, 0xffffffff
add esp, 0x1018
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov esi, eax
mov eax, edi
add dword [esp + 8], 1
shl esi, 8
movzx edi, al
mov dword [esp + 4], ebx
and si, 0xf00
or esi, edi
jmp 0x4147e4
movzx ebx, si
lea eax, [esp + 0x19]
jmp 0x414913
lea ebx, [ebx + ebx*2]
add eax, 1
lea edi, [ebx + ebx + 0x50ac60]
movzx ebx, byte [edi + 4]
mov byte [eax - 1], bl
movzx ebx, word [edi + 2]
lea edi, [esp + 0x1018]
cmp eax, edi
je 0x4148a0
cmp ebx, 0xff
jg 0x4148f0
jmp 0x41483c
movzx eax, di
movzx ebx, word [esp + 0x12]
add edi, 1
lea eax, [eax + eax*2]
mov word [esp + 0xe], di
lea eax, [eax + eax + 0x50ac60]
mov word [eax + 2], bx
movzx ebx, byte [esp + 0x11]
mov byte [eax + 4], bl
jmp 0x414888
xor eax, eax
jmp 0x4148a5
Function at 0x41b2e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
mov esi, 0x437534
push ebx
sub esp, 0x8c
fld dword [0x4375dc]
mov edx, dword [0x512674]
mov dword [esp + 0x38], 0
lea ebp, [esp + 0x38]
lea edi, [esp + 0x44]
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x3c], 0
mov ebx, dword [esp + 0xa0]
mov dword [esp + 0x44], eax
mov eax, dword [0x512670]
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], eax
mov eax, dword [0x512670]
mov dword [esp + 0x7c], 0
mov dword [esp + 0x54], 0
shl eax, 2
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x50], 2
mov dword [esp + 0x4c], edx
mov dword [esp + 0x64], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x6c], 3
fst dword [esp + 0x74]
mov dword [esp + 0x2c], eax
mov eax, 0x57
fstp dword [esp + 0x70]
lea esi, [esi]
nop
mov dword [esp + 0x68], eax
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x64]
add esi, 4
mov edx, dword [eax]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x38]
sub esp, 0x10
test eax, eax
jns 0x41b3cf
mov eax, dword [esi]
test eax, eax
jne 0x41b3a0
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x41b530
mov eax, dword [esp + 0x68]
mov esi, dword [ecx]
mov dword [esp + 0xc], 0
mov edx, dword [esp + 0x6c]
fld dword [0x4375dc]
mov dword [esp], ecx
mov dword [esp + 0x54], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x54]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x58], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
fst dword [esp + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
fstp dword [esp + 0x5c]
call dword [esi + 0x10]
sub esp, 0x1c
test eax, eax
js 0x41b4f0
mov eax, dword [esp + 0x68]
cmp eax, 0x56
jbe 0x41b451
mov edx, dword [0x503ff4]
cmp dword [edx + 0x20], 0x17
jg 0x41b48d
cmp eax, 0x56
mov dword [esp], 0x20
setbe al
movzx eax, al
mov dword [esp + 4], eax
call fcn.00422050
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0x2c]
imul eax, dword [esp + 0x4c]
mov dword [esp], 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_calloc
mov dword [ebx + 0x24], eax
test eax, eax
je 0x41b4f0
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x3c]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x437540
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
test eax, eax
js 0x41b4f0
mov eax, dword [esp + 0x38]
mov dword [ebx + 0x18], 0x41a540
mov dword [ebx + 0x1c], fcn.0041b2e0
mov dword [ebx + 0x12c], eax
mov eax, dword [esp + 0x3c]
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [ebx + 0x14], eax
add esp, 0x8c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x40]
test eax, eax
je 0x41b503
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [esp + 0x38]
test eax, eax
je 0x41b516
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
add esp, 0x8c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x41b4f8
jmp 0x41b516
Function at 0x41d980
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push ebx
sub esp, 0x114
mov eax, dword [0x51266c]
test eax, eax
jne 0x41d9a0
call fcn.00417e90
add esp, 0x114
pop ebx
pop esi
ret
lea eax, [esp + 0x10]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
movzx eax, byte [0x4383a0]
mov edx, 0x4383a1
sub esp, 4
test al, al
jne 0x41d9dc
jmp 0x41d991
or cl, byte [esp + ebx + 0x10]
shr cl, 7
mov byte [eax], cl
movzx eax, byte [edx + 2]
add edx, 3
test al, al
je 0x41d991
movzx ecx, byte [edx]
mov esi, dword [0x503ff4]
movzx ebx, byte [edx + 1]
movzx ecx, byte [esp + ecx + 0x10]
add eax, dword [esi + 0x64]
test bl, bl
jne 0x41d9c8
shr cl, 7
mov byte [eax], cl
jmp 0x41d9d1
Function at 0x423c90
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004238f0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004238f0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x423cf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x50613c]
test esi, esi
jle 0x423df0
mov eax, dword [0x506140]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x423d20
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x423d9f
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x423d10
mov dword [esp], ebx
call fcn.00424660
mov edi, eax
test eax, eax
je 0x423e17
mov eax, dword [0x506140]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00424770
mov edx, dword [0x506140]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x423df7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x423d98
sub eax, 4
and eax, 0xfffffffb
jne 0x423da6
add dword [0x50613c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x506140]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x423d98
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00423c90
xor esi, esi
jmp 0x423d2a
mov eax, dword [0x506140]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00423c90
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00423c90
lea esi, [esi]
nop