joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10516b5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x10
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x10516d1
mov eax, 0x80004003
jmp 0x105186a
push esi
push edi
mov dword [eax], ebx
movzx eax, word [ebp + 0xc]
push 0x1004dd0
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xc], eax
mov edi, 0xffff
mov esi, 0x80070000
test eax, eax
jne 0x1051709
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1051707
and eax, edi
or eax, esi
mov ebx, eax
and dword [ebp - 8], 0
test ebx, ebx
jl 0x1051734
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
test eax, eax
jne 0x1051734
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1051732
and eax, edi
or eax, esi
mov ebx, eax
and dword [ebp + 0xc], 0
test ebx, ebx
jl 0x105175f
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x105175f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x105175d
and eax, edi
or eax, esi
mov ebx, eax
and dword [ebp - 0xc], 0
test ebx, ebx
jl 0x105178d
cmp dword [ebp + 0xc], 0
je 0x105178d
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x105178d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x105178b
and eax, edi
or eax, esi
mov ebx, eax
and dword [ebp + 8], 0
test ebx, ebx
jl 0x10517b7
push dword [ebp - 8]
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp + 8], eax
test eax, eax
jne 0x10517b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10517b5
and eax, edi
or eax, esi
mov ebx, eax
and dword [ebp - 4], 0
test ebx, ebx
jl 0x1051806
cmp dword [ebp + 8], 0
je 0x10517e5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10517e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10517e3
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jl 0x1051806
cmp dword [ebp - 0xc], 0
je 0x1051806
cmp dword [ebp - 4], 0
je 0x1051806
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.msvcrt.dll_memcpy
add esp, 0xc
and dword [ebp - 0x10], 0
pop edi
pop esi
test ebx, ebx
jl 0x1051834
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ebx, eax
test ebx, ebx
jl 0x1051834
push 0
push dword [ebp - 0x10]
call fcn.01051528
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
cmp dword [ebp + 8], 0
je 0x105184c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp + 0xc], 0
je 0x105185b
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1051868
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x1052eab
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 8]
mov dword [ebp - 8], esi
mov byte [ebp - 4], bl
call fcn.0100fb9c
mov eax, dword [ebp + 8]
push ebx
push 0x42000000
push 3
push ebx
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0xc]
push 7
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x38]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x20], eax
cmp eax, ebx
jne 0x1052f04
cmp byte [ebp - 4], bl
je 0x1052efd
lea ecx, [ebp - 8]
call fcn.0100fbcf
mov eax, 0x80004003
jmp 0x1052f3b
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi + 0x34], eax
cmp eax, ebx
je 0x1052ef0
push ebx
push ebx
push esi
push 0x1052e76
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x30], eax
cmp eax, ebx
je 0x1052ef0
cmp byte [ebp - 4], bl
je 0x1052f39
lea ecx, [ebp - 8]
call fcn.0100fbcf
xor eax, eax
pop esi
pop ebx
leave
ret 8

Function at 0x1052f92
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1052feb
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1052fdd
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x1052fd9
cmp esi, eax
jae 0x1052fdd
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x1052fcb
cmp esi, eax
jb 0x1052fe1
xor eax, eax
jmp 0x1052fea
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x402d3c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004043cc
test esi, esi
jne 0x402d73
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.004044bc
jmp 0x402d94
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402bd8
mov dword [esp], eax
test esi, esi
je 0x402d94
cmp dword [ebx], 0
je 0x402d94
dec esi
jmp 0x402d7b
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4032c4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x424008], 0x8088405
inc edx
mov dword [ebx + 0x424008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403510
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x424018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4035a8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403588
xor eax, eax
push ebp
push 0x403581
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4035c4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403588
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x424018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x424018], ax
mov esp, ebp
pop ebp
ret

Function at 0x4041a4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x425044], 0
je 0x404205
cmp word [0x425218], 0xd7b2
jne 0x4041cd
cmp dword [0x425220], 0
jbe 0x4041cd
mov eax, 0x425214
call dword [0x425230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x424084
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40422c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x424024], 0
jne 0x404221
push 0
push 0x42407c
push 0x424084
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404380
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402a38
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x425045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404348
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4060c8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40612e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040464c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403404
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406118
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406135
lea eax, [ebp - 0x10]
call fcn.004043cc
ret

Function at 0x4085a8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
test dl, dl
je 0x4085ba
add esp, 0xfffffff0
call fcn.00403944
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
push 0xa
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x425660]
push eax
call sub.kernel32.dll_FindResourceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x408649
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [0x425660]
push eax
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x408649
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_LockResource
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x40862b
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [0x425660]
push eax
call sub.kernel32.dll_SizeofResource
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov dl, 1
mov eax, dword [0x406a58]
call fcn.00403644
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x408661
call fcn.0040399c
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x408a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx ecx, byte [eax + 1]
push ebx
push esi
push edi
mov eax, dword [ecx + eax + 0xb]
movzx ebx, byte [edx]
mov eax, dword [eax]
xor edi, edi
movzx ecx, byte [eax + 1]
or ebx, ebx
mov esi, dword [ecx + eax + 7]
lea eax, [ecx + eax + 0xf]
je 0x408ab4
movzx ecx, byte [eax]
cmp ecx, ebx
je 0x408abb
cmp edi, esi
lea edi, [edi + 1]
lea eax, [ecx + eax + 1]
jne 0x408aa2
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
push eax
push edx
inc eax
inc edx
mov ch, byte [eax]
xor ch, byte [edx]
and ch, 0xdf
jne 0x408ad2
dec cl
jne 0x408abd
pop edx
pop edx
mov eax, edi
jmp 0x408ab7
pop edx
pop eax
mov ecx, ebx
jmp 0x408aa9

Function at 0x409b54
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x409b73
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 0
pop ecx
pop ebp
ret
Function at 0x40b15c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x40b18b
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x40b194
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x40b1c3
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x40b1cc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x40b1f0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_RemoveDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x40b214
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40b239
test byte [ebp - 0xc], 0x10
sete byte [ebp - 5]
jmp 0x40b26d
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
je 0x40b264
cmp dword [ebp - 0x10], 3
je 0x40b264
cmp dword [ebp - 0x10], 0x7b
je 0x40b264
cmp dword [ebp - 0x10], 0x20
je 0x40b268
mov eax, dword [ebp - 4]
call fcn.0040b274
inc eax
jne 0x40b268
xor eax, eax
jmp 0x40b26a
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x40b2ec
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x40b318
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x40b33c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40b35d
test byte [ebp - 0xc], 0x10
jne 0x40b361
xor eax, eax
jmp 0x40b363
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x40b544
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov esi, eax
mov edi, edx
mov eax, edx
xor edx, edx
test esi, esi
je 0x40b556
mov edx, dword [esi - 4]
lea ebx, [edx - 4]
call fcn.0040497c
mov edi, dword [edi]
add esi, ebx
add edi, ebx
neg ebx
jg 0x40b594
mov eax, dword [ebx + esi]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
sub ecx, eax
mov dword [ebx + edi], ecx
add ebx, 4
jle 0x40b568
sub ebx, 4
je 0x40b5b2
movzx eax, byte [ebx + esi + 4]
lea edx, [eax - 0x61]
cmp edx, 0x1a
sbb ecx, ecx
and ecx, 0x20
sub eax, ecx
mov byte [ebx + edi + 4], al
inc ebx
jne 0x40b599
pop ebx
pop esi
pop edi
ret

Function at 0x40ce08
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x34], 0xffffff
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc0], 0
jne 0x40ce48
mov eax, dword [ebp - 4]
mov dword [eax + 0xc0], 0x420100c0
mov eax, dword [ebp - 4]
cmp byte [eax + 0xbc], 0x2a
jne 0x40ce48
mov eax, dword [ebp - 4]
or dword [eax + 0xc0], 0x20
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00411090
push eax
push 0
mov eax, dword [0x425660]
push eax
push 0
mov edx, 0x40cf00
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x50]
mov eax, 0x10200
call fcn.004067fc
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00410700
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb8]
push eax
push 0
push 0xc
mov eax, dword [ebp - 4]
call fcn.00411090
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 4]
cmp byte [eax + 0x64], 0
jne 0x40ced8
push 0
mov eax, dword [ebp - 4]
call fcn.00411090
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
cmp byte [eax + 0xbd], 0
je 0x40cefc
push 0
push 1
push 0xcf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0]
push eax
call sub.user32.dll_SendMessageA
pop ecx
pop ebp
ret
Function at 0x40d5e4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40d706
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xbc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0xd0]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00411090
push eax
push 0
mov eax, dword [0x425660]
push eax
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xb8]
mov eax, 0x10000
call fcn.004067fc
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00410700
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0xc]
dec eax
test eax, eax
jl 0x40d6c5
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 8]
call fcn.00407d6c
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0]
push eax
call sub.user32.dll_SendMessageA
inc dword [ebp - 8]
dec dword [ebp - 0xc]
jne 0x40d687
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xd8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x64], 0
jne 0x40d6f0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d70d
lea eax, [ebp - 0x10]
call fcn.004043cc
ret

Function at 0x40f470
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x170], 0
push 0x40f514
mov eax, dword [0x425660]
push eax
call sub.user32.dll_LoadIconA
mov edx, dword [ebp - 4]
mov dword [edx + 0x168], eax
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x28
call fcn.004032a4
mov eax, dword [0x425660]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 3
mov eax, sub.user32.dll_DefWindowProcA
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x168]
mov dword [ebp - 0x18], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, 0x40f520
mov dword [ebp - 8], eax
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_RegisterClassA
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0x154
push 0
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
push 0
push 0x29
call sub.user32.dll_SystemParametersInfoA
mov esp, ebp
pop ebp
ret
Function at 0x40fbe8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov word [ebp - 2], ax
mov byte [ebp - 3], 0
test byte [ebp - 2], 4
je 0x40fbfe
or byte [ebp - 3], 1
test byte [ebp - 2], 8
je 0x40fc08
or byte [ebp - 3], 4
test byte [ebp - 2], 1
je 0x40fc12
or byte [ebp - 3], 8
test byte [ebp - 2], 2
je 0x40fc1c
or byte [ebp - 3], 0x10
test byte [ebp - 2], 0x10
je 0x40fc26
or byte [ebp - 3], 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x40fc36
or byte [ebp - 3], 2
mov al, byte [ebp - 3]
pop ecx
pop ebp
ret

Function at 0x40fc3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x40fc59
or byte [ebp - 5], 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x40fc69
or byte [ebp - 5], 4
test byte [ebp - 1], 0x20
je 0x40fc73
or byte [ebp - 5], 2
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x413020
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x15], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4130c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00407eb8
mov dword [ebp - 8], 0x43
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 0xc], eax
shr dword [ebp - 0xc], 2
xor eax, eax
mov dword [ebp - 0x10], eax
test dword [ebp - 0xc], 1
jbe 0x413098
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
call fcn.004045b4
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x14]
mov ecx, 0x4130d8
call fcn.004046e8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
call fcn.00407df4
shr dword [ebp - 0xc], 1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x18
jne 0x413064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4130c9
lea eax, [ebp - 0x24]
call fcn.004043cc
lea eax, [ebp - 0x14]
call fcn.004043cc
ret