joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f3cfc
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x562bf0], 0
jne 0x4f3d7d
cmp dword [0x562c20], 0
jne 0x4f3d2c
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x562c20], eax
test eax, eax
jne 0x4f3d2c
push 0x551ebc
call fcn.004f338c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x562c20]
jmp 0x4f3d40
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004e9294
pop ecx
mov edi, eax
test eax, eax
jne 0x4f3d38
lea edi, [ebp + 1]
push edi
call fcn.004e82ec
pop ecx
mov ebx, eax
mov dword [0x562bf4], ebx
test ebx, ebx
jne 0x4f3d6a
xor eax, eax
jmp 0x4f3e40
push edi
mov edx, dword [0x562c20]
push edx
push ebx
call fcn.004e8ee0
add esp, 0xc
jmp 0x4f3d9d
xor esi, esi
mov ebx, dword [0x562bf0]
jmp 0x4f3d97
push eax
call fcn.004e9294
pop ecx
test eax, eax
jne 0x4f3d93
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4f3d87
lea ebx, [esi + 4]
push 4
mov dword [0x562bf8], ebx
inc ebx
push ebx
call fcn.004e8250
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4f3dc0
xor eax, eax
jmp 0x4f3e40
cmp dword [0x562bf0], 0
jne 0x4f3df1
xor esi, esi
mov ebx, dword [0x562bf4]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4f3de2
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004e9294
pop ecx
mov edi, eax
test eax, eax
jne 0x4f3dd8
jmp 0x4f3e22
xor esi, esi
mov ebx, dword [0x562bf0]
mov eax, dword [esp]
mov edi, eax
jmp 0x4f3e1c
push eax
call fcn.004e9294
pop ecx
test eax, eax
je 0x4f3e11
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4f3e15
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4f3e00
mov eax, dword [0x562bf0]
test eax, eax
je 0x4f3e32
push eax
call fcn.004e82fc
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x562bf0], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f3ed8
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x562c00], 0
jne 0x4f3f64
cmp dword [0x562c34], 0
jne 0x4f3f08
call sub.KERNEL32.DLL_GetEnvironmentStringsW
mov dword [0x562c34], eax
test eax, eax
jne 0x4f3f08
push str.GetEnvironmentStrings_failed
call fcn.004f338c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x562c34]
jmp 0x4f3f21
lea eax, [edi + 1]
add edi, edi
add edi, 2
add ebp, eax
inc esi
add ebx, edi
push ebx
call fcn.004e9560
pop ecx
mov edi, eax
test eax, eax
jne 0x4f3f14
lea edi, [ebp + 1]
mov eax, edi
add eax, eax
push eax
call fcn.004e82ec
pop ecx
mov ebx, eax
mov dword [0x562c04], ebx
test ebx, ebx
jne 0x4f3f4f
xor eax, eax
jmp 0x4f402b
add edi, edi
mov edx, dword [0x562c34]
push edi
push edx
push ebx
call fcn.004e8ee0
add esp, 0xc
jmp 0x4f3f84
xor esi, esi
mov ebx, dword [0x562c00]
jmp 0x4f3f7e
push eax
call fcn.004e9560
pop ecx
test eax, eax
jne 0x4f3f7a
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4f3f6e
lea ebx, [esi + 4]
push 4
mov dword [0x562c08], ebx
inc ebx
push ebx
call fcn.004e8250
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4f3fa7
xor eax, eax
jmp 0x4f402b
cmp dword [0x562c00], 0
jne 0x4f3fdc
xor esi, esi
mov ebx, dword [0x562c04]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4f3fcd
mov dword [ebp], ebx
add edi, edi
add ebp, 4
add edi, 2
inc esi
add ebx, edi
push ebx
call fcn.004e9560
pop ecx
mov edi, eax
test eax, eax
jne 0x4f3fbf
jmp 0x4f400d
xor esi, esi
mov ebx, dword [0x562c00]
mov eax, dword [esp]
mov edi, eax
jmp 0x4f4007
push eax
call fcn.004e9560
pop ecx
test eax, eax
je 0x4f3ffc
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4f4000
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4f3feb
mov eax, dword [0x562c00]
test eax, eax
je 0x4f401d
push eax
call fcn.004e82fc
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x562c00], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4f4b68
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x4f4b8e
test esi, esi
je 0x4f4b8e
call fcn.004f31e4
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x4f4c00
call fcn.004f486c
mov ebx, eax
test eax, eax
jne 0x4f4ba9
call fcn.004f31e4
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x4f4c00
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebx + 4], edx
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
mov ecx, dword [ebp + 0x20]
mov dword [ebx + 0x58], ecx
push eax
mov edx, dword [ebp + 0x18]
push edx
push ebx
push 0x4f4ac4
push esi
mov ecx, dword [ebp + 0x14]
push ecx
call sub.KERNEL32.DLL_CreateThread
test eax, eax
jne 0x4f4bf4
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x718
jne 0x4f4bed
push 0x59
call fcn.004eb594
pop ecx
jmp 0x4f4c00
call fcn.004eb600
jmp 0x4f4c00
mov dword [ebx + 8], eax
test edi, edi
je 0x4f4c00
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4f7ac4
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.00469564
mov ebp, eax
push ebp
call sub.KERNEL32.DLL_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x44f731
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
push ebp
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x44f72b
test ah, 4
je 0x44f72b
test al, 0x10
je 0x44f72b
mov eax, esi
call fcn.00469564
push eax
call sub.KERNEL32.DLL_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x44f731
push edi
call sub.KERNEL32.DLL_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
jmp 0x44f6dc

Function at 0x4feecc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
test ecx, ecx
jle 0x4feef6
mov ebx, eax
shl ebx, 3
xor eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
movzx ebx, byte [ebx + 0x5539f8]
xor eax, ebx
dec ecx
test ecx, ecx
jg 0x4feedc
pop ebx
pop ebp
ret

Function at 0x4ffb28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
push ebx
push esi
push edi
mov eax, dword [0x55754c]
test eax, eax
je 0x4ffb5c
push eax
lea edx, [ebp - 0x108]
push 0x557c5a
push edx
push 0xe6
call fcn.004fd8f0
add esp, 0x10
jmp 0x4ffc09
call fcn.004ff26c
test eax, eax
je 0x4ffbb8
lea ecx, [ebp - 0x310]
push ecx
push 0xe6
call sub.KERNEL32.DLL_GetTempPathW
lea eax, [ebp - 0x310]
push eax
call fcn.004ff310
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4ffbac
push ebx
lea eax, [ebp - 0x108]
push 0x557c5d
push eax
push 0xe6
call fcn.004fd8f0
add esp, 0x10
push ebx
call fcn.004e82fc
pop ecx
jmp 0x4ffc09
mov eax, 7
jmp 0x4ffc9e
lea edx, [ebp - 0x414]
push edx
push 0xe6
call sub.KERNEL32.DLL_GetTempPathA
lea ecx, [ebp - 0x414]
push ecx
call fcn.004ff448
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4ffbff
push ebx
lea eax, [ebp - 0x108]
push 0x557c60
push eax
push 0xe6
call fcn.004fd8f0
add esp, 0x10
push ebx
call fcn.004e82fc
pop ecx
jmp 0x4ffc09
mov eax, 7
jmp 0x4ffc9e
lea edx, [ebp - 0x108]
push edx
call fcn.004fe1ec
pop ecx
mov ecx, eax
lea eax, [ebp + ecx - 0x109]
jmp 0x4ffc23
dec ecx
dec eax
test ecx, ecx
jbe 0x4ffc2c
cmp byte [eax], 0x5c
je 0x4ffc21
mov byte [ebp + ecx - 0x108], 0
lea edx, [ebp - 0x108]
push edx
push str._setilqs_
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
add eax, 0xffffffe2
push eax
call fcn.004fd8f0
add esp, 0x10
mov edx, dword [ebp + 0xc]
push edx
call fcn.004fe1ec
mov esi, eax
mov eax, dword [ebp + 0xc]
add eax, esi
pop ecx
push eax
push 0x14
call fcn.004fda00
mov edx, dword [ebp + 0xc]
add esp, 8
xor ecx, ecx
lea ebx, [edx + esi]
mov eax, ebx
mov edi, 0x3e
xor edx, edx
movzx eax, byte [eax]
div edi
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [ebx], al
inc ecx
inc ebx
inc esi
cmp ecx, 0x14
jb 0x4ffc77
mov edx, dword [ebp + 0xc]
xor eax, eax
mov byte [edx + esi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5000a8
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
mov dword [ebp - 4], pe_nt_image_headers32
xor esi, esi
lea eax, [ebp - 0x110]
push eax
push 0x104
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004fffb4
add esp, 0x10
test eax, eax
jne 0x500177
lea eax, [ebp - 0x110]
push eax
call fcn.004ffb04
pop ecx
mov ebx, eax
test ebx, ebx
je 0x50016c
call fcn.004ff26c
test eax, eax
je 0x500136
mov eax, ebx
jmp 0x500112
movzx edx, dx
cmp edx, 0x5c
jne 0x50010f
mov word [eax], 0
jmp 0x50011c
add eax, 2
mov edx, eax
mov dx, word [edx]
test dx, dx
jne 0x500100
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
push edx
push ebx
call sub.KERNEL32.DLL_GetDiskFreeSpaceW
mov esi, eax
jmp 0x500165
mov eax, ebx
jmp 0x500145
cmp dl, 0x5c
jne 0x500144
mov byte [eax], 0
jmp 0x50014d
inc eax
mov edx, eax
mov dl, byte [edx]
test dl, dl
jne 0x50013a
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
push edx
push ebx
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
mov esi, eax
push ebx
call fcn.004e82fc
pop ecx
test esi, esi
jne 0x500177
mov dword [ebp - 4], pe_nt_image_headers32
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51ab20
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test esi, esi
jne 0x51ab37
xor eax, eax
jmp 0x51ac3c
push 0x44
push edi
call fcn.004fc5b8
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x51ab4f
xor eax, eax
jmp 0x51ac3c
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [esi]
push ecx
push edi
call fcn.0051a804
add esp, 0xc
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [esi + 8]
push edx
push edi
call fcn.0051a904
add esp, 0xc
mov dword [ebx + 8], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [esi + 0xc]
push eax
push edi
call fcn.0051a7e8
add esp, 0xc
mov dword [ebx + 0xc], eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [esi + 0x10]
push ecx
push edi
call fcn.0051a804
add esp, 0xc
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [esi + 0x14]
push edx
push edi
call fcn.0051a7e8
add esp, 0xc
mov dword [ebx + 0x14], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [esi + 0x18]
push eax
push edi
call fcn.0051a804
mov edx, esi
mov dword [ebx + 0x18], eax
add esp, 0xc
mov cl, byte [edx + 4]
mov byte [ebx + 4], cl
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [esi + 0x1c]
push edx
push edi
call fcn.0051ab20
add esp, 0xc
mov dword [ebx + 0x1c], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [esi + 0x28]
push eax
push edi
call fcn.0051a7e8
add esp, 0xc
mov dword [ebx + 0x28], eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [esi + 0x2c]
push ecx
push edi
call fcn.0051a7e8
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
xor edx, edx
mov dword [ebx + 0x34], edx
add esp, 0xc
mov cx, word [esi + 6]
and cx, 0xfff7
xor eax, eax
mov word [ebx + 6], cx
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x3c], 0xffffffff
mov dword [ebx + 0x40], 0xffffffff
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x53cecc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
lea esi, [ebp - 0x40]
mov eax, 0x55b6cc
call fcn.004e95f0
mov dword [esi + 0x1c], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.004f8554
inc dword [esi + 0x1c]
mov word [esi + 0x10], 0xc
cmp byte [edi + 0x18], 0
jne 0x53cf2a
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [esi + 0x1c]
call fcn.004f86a4
pop eax
mov edx, dword [esi]
mov dword fs:[0], edx
jmp 0x53d099
mov word [esi + 0x10], 0x18
xor ecx, ecx
xor eax, eax
mov dword [ebp - 8], ecx
xor ebx, ebx
inc dword [esi + 0x1c]
inc dword [esi + 0x1c]
lea ecx, [ebp - 0xc]
mov word [esi + 0x10], 0xc
mov word [esi + 0x10], 0x24
mov dword [ebp - 0xc], eax
mov eax, str.SELECT_name_FROM_sqlite_master_WHERE_name
inc dword [esi + 0x1c]
lea edx, [ebp - 4]
call fcn.004f8ab4
lea edx, [ebp - 0xc]
push edx
mov edx, 0x55b3e1
lea eax, [ebp - 0x10]
call fcn.004f8514
inc dword [esi + 0x1c]
xor eax, eax
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x10]
inc dword [esi + 0x1c]
lea ecx, [ebp - 0x14]
pop eax
call fcn.004f86f4
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
xor ecx, ecx
call fcn.004f7d1c
inc dword [esi + 0x1c]
inc dword [esi + 0x1c]
lea edx, [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.004f7df4
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00402190
dec dword [esi + 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004f86a4
dec dword [esi + 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004f86a4
dec dword [esi + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004f86a4
push 0
lea ecx, [ebp - 0x44]
push ecx
push 0xffffffffffffffff
cmp dword [ebp - 8], 0
jne 0x53cffd
mov ecx, 0x55b3e3
jmp 0x53d000
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [edi + 0x14]
push eax
call fcn.0052b670
add esp, 0x14
test eax, eax
jne 0x53d061
mov edx, dword [ebp - 0x44]
push edx
call fcn.00511410
pop ecx
cmp eax, 0x64
jne 0x53d061
mov word [esi + 0x10], 0x30
push 0
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.00511878
add esp, 8
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.004f8514
inc dword [esi + 0x1c]
lea edx, [ebp - 4]
call fcn.004f8778
push eax
dec dword [esi + 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004f86a4
pop eax
test al, al
je 0x53d061
mov bl, 1
mov eax, dword [ebp - 0x44]
push eax
call fcn.00510e00
pop ecx
mov eax, ebx
push eax
lea eax, [ebp - 8]
sub dword [esi + 0x1c], 2
mov edx, 2
call fcn.00402190
dec dword [esi + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004f86a4
pop eax
mov edx, dword [esi]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53e190
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x5407d8
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov edx, 0x55bf67
mov ecx, 1
mov eax, esi
call fcn.0053ed98
push 0
push ebx
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
test eax, eax
je 0x540809
mov bl, 1
jmp 0x54080b
xor ebx, ebx
mov edx, str.SeDebugPrivilege
xor ecx, ecx
mov eax, esi
call fcn.0053ed98
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x402868
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402897
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040398c
jmp 0x4028b5
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004027f0
mov edi, eax
test ebx, ebx
je 0x4028b5
cmp dword [esi], 0
je 0x4028b5
dec ebx
jmp 0x40289e
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402b6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402c04
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402be4
xor eax, eax
push ebp
push 0x402bdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402c20
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402be4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x404bf4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404dac
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404c55
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404dc8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404cc2
xor eax, eax
push ebp
push 0x404cbb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404ca4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404de8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404cc2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404da3
cmp byte [ebp - 0xd], 0
jne 0x404d04
cmp byte [ebp - 0x12], 0
je 0x404da3
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404d1d
dec ebx
cmp byte [ebx], 0x2e
je 0x404d2c
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404d1c
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404da3
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404d59
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404da3
cmp byte [ebp - 0xd], 0
je 0x404da3
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404da3
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408364
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40839d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040398c
jmp 0x4083a6
mov eax, ebx
mov edx, esi
call fcn.00403940
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4083b0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4083d1
mov al, byte [esp]
jmp 0x4083d3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x413688
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41368e
ret

Function at 0x415b3c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x415b8d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x415b74
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x415b64
jmp 0x415b8d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x415b75
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421c58
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x447758], 0
sete dl
or al, dl
jne 0x421d9c
mov eax, dword [0x44775c]
mov bx, 0xffff
call fcn.00402ed0
mov eax, dword [0x447758]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x421d6b
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x447758]
call fcn.0040ce04
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
je 0x421d63
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x16c], 0
je 0x421d63
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x421d63
mov eax, dword [ebp - 0x10]
call fcn.00429aec
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x421d63
push ebp
call fcn.00421c14
pop ecx
test al, al
jne 0x421d63
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x8c]
cmp eax, dword [ebp - 0x10]
jne 0x421d1f
mov eax, dword [ebp - 0x10]
call fcn.00428430
dec eax
jle 0x421d63
mov byte [ebp - 0x15], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x15]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov bx, 0xffc2
call fcn.00402ed0
cmp byte [ebp - 0x15], 0
je 0x421d63
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x421d63
mov edx, dword [ebp - 0x10]
mov eax, dword [0x44775c]
call fcn.004214c4
inc edi
dec esi
jne 0x421cb2
mov eax, dword [0x44775c]
cmp dword [eax + 8], 0
jle 0x421d83
mov eax, dword [0x44775c]
call fcn.00421554
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x421d9c
push ebp
mov eax, dword [ebp - 0x14]
call fcn.00421acc
pop ecx
test al, al
jne 0x421d9c
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret