joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407004
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x4070c2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
jne 0x407044
lea eax, [ebp - 0xc]
mov edx, 0x4070d8
call fcn.004037c4
mov eax, dword [ebp - 0xc]
call fcn.004038a4
test eax, eax
jns 0x407055
call fcn.00402f14
push eax
lea eax, [ebp - 0xc]
call fcn.00403af4
mov edx, 1
dec edx
test eax, eax
je 0x40706d
cmp edx, dword [eax - 4]
jb 0x407072
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x407097
call fcn.00402f14
mov dword [0x41e6bc], eax
cmp dword [0x41e6bc], 0
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4070c9
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret

Function at 0x4070dc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x40714c
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x407126
call fcn.00402f14
mov dword [0x41e6bc], eax
cmp dword [0x41e6bc], 0
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407153
lea eax, [ebp - 8]
call fcn.0040372c
ret

Function at 0x40715c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x407208
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41e6b8
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jns 0x4071b0
call fcn.00402f14
mov dword [0x41e6bc], eax
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
jns 0x4071d2
call fcn.00402f14
mov dword [0x41e6bc], eax
cmp dword [0x41e6bc], 0
sete byte [ebp - 0xd]
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40720f
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret
Function at 0x408aa8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x408ab0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x409d03
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41eb54
mov edx, 0x409d18
call fcn.00403780
call fcn.0040825c
mov eax, dword [ebp - 8]
call fcn.0040372c
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0x41eb54
mov edx, 0x409dcc
call fcn.00403780
mov eax, dword [ebp - 4]
call fcn.004038a4
cmp eax, 0x7f
jge 0x408b3c
push 0
push 0x41ec20
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x41ebcc], eax
cmp dword [0x41ebcc], 0xffffffff
jne 0x408b71
mov dword [ebp - 0xc], 1
jmp 0x408b71
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x41ebcc], eax
cmp dword [0x41ebcc], 0xffffffff
jne 0x408b71
mov dword [ebp - 0xc], 2
mov eax, 0x41eb54
mov edx, 0x409e8c
call fcn.00403780
cmp dword [ebp - 0xc], 0
jbe 0x408bf9
mov eax, 0x41eb54
mov edx, 0x409ee4
call fcn.00403780
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 0xcf
ja 0x408bae
bt dword [0x409fb0], eax
jb 0x408be9
cmp dword [ebp - 0xc], 0x4cf
je 0x408be9
push 0x409fd4
push dword [ebp - 4]
push 0x409fe4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00406434
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00403964
mov eax, dword [ebp - 0x14]
call fcn.00412764
mov eax, dword [0x41ebcc]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x409ce0
mov eax, 0x41eb54
mov edx, 0x409ff0
call fcn.00403780
mov eax, 0x41ebfc
call fcn.0040372c
mov eax, 0x41ec00
call fcn.0040372c
mov eax, 0x41ec04
call fcn.0040372c
xor eax, eax
mov dword [0x41ebf0], eax
xor eax, eax
mov dword [0x41ebf4], eax
xor eax, eax
mov dword [0x41ebf8], eax
inc ecx
add byte [ebx], dh
shl byte [ebx + 0x41ebec], 0xb8
or ah, ch
inc ecx
add byte [edx + 0x12], bh
Function at 0x40a3a8
Capabilities:
Hide graphical window

Disassembly:
inc ebp
pop eax
inc ebp
dec esi
popal
insd dword es:[edi], dx
add byte gs:[ebx + 0x4f], dl
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x40a3f7
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
add byte cs:[eax], al
add byte [eax], al
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 8]
push eax
call sub.user32.dll_ShowWindow
cmp eax, 1
sbb eax, eax
inc eax
mov byte [0x41eb10], al
mov al, byte [0x41eb10]
xor al, 1
neg al
sbb eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret 8
dec dword [ecx + 0x4d89884d]
test byte [ecx + 0x4d89904d], cl
mov word [ecx + 0x4d89944d], cs
invalid

Function at 0x40a3d8
Capabilities:
Create directory
Create process on windows
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
xor ecx, ecx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x40a8b7
push dword fs:[eax]
mov dword fs:[eax], esp

Function at 0x40ad10
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x31
push 0
push 0
dec ecx
jne 0x40ad18
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x40b3ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41eb54
mov edx, 0x40b3d0
call fcn.00403780
call fcn.0040825c
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x15c]
mov ecx, 0x40b3f4
mov edx, dword [ebp - 4]
call fcn.004038f0
mov eax, dword [ebp - 0x15c]
call fcn.00403aa4
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 8], eax
mov eax, 0x41eb54
mov edx, 0x40b400
call fcn.00403780
cmp dword [ebp - 8], 0xffffffff
je 0x40b360
Function at 0x40b9ac
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40bd11
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41eb54
mov edx, 0x40bd24
call fcn.00403780
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x13
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jns 0x40ba02
call fcn.00402f14
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40bcf6
mov eax, 0x41eb54
mov edx, 0x40bd78
call fcn.00403780
mov dword [ebp - 0x10], 0x7e0
mov eax, dword [ebp - 0x10]
call fcn.004024d0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00402bd8
mov dword [ebp - 0xc], 0x3f
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
jns 0x40ba62
call fcn.00402f14
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40ba78
cmp dword [ebp - 0x18], 0xea
jne 0x40bcb1
mov eax, dword [ebp - 0xc]
sub eax, 1
jae 0x40ba85
call fcn.00402f1c
test eax, eax
jns 0x40ba8e
call fcn.00402f14
test eax, eax
jl 0x40ba3d
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, 0x3e
jbe 0x40baaa
call fcn.00402f14
imul eax, eax, 4
jno 0x40bab4
call fcn.00402f1c
mov edx, dword [ebp - 0x1c]
test byte [edx + eax*8 + 0xc], 2
je 0x40bae0
mov eax, dword [ebp - 0x14]
cmp eax, 0x3e
jbe 0x40bacb
call fcn.00402f14
imul eax, eax, 4
jno 0x40bad5
call fcn.00402f1c
mov edx, dword [ebp - 0x1c]
lea eax, [edx + eax*8]
call fcn.0040b9ac
mov eax, dword [ebp - 0x14]
cmp eax, 0x3e
jbe 0x40baed
call fcn.00402f14
imul eax, eax, 4
jno 0x40baf7
invalid
invalid
Function at 0x40c7c4
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x42
push 0
push 0
dec ecx
jne 0x40c7cc
push ecx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40ce1b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00416310
cmp byte [0x41d294], 0
jne 0x40c814
lea eax, [ebp - 0x1b4]
mov ecx, dword [0x41ebc8]
mov edx, 0x40ce34
call fcn.004038f0
mov eax, dword [ebp - 0x1b4]
call fcn.00412764
mov byte [ebp - 9], 0
lea eax, [ebp - 0x1a0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 4], eax
mov word [ebp - 0x1b0], 2
push 0x19
call sub.wsock32.dll_htons
mov word [ebp - 0x1ae], ax
lea edx, [ebp - 0x1b8]
mov eax, dword [0x41ebb8]
call fcn.004062e0
mov edx, dword [ebp - 0x1b8]
mov eax, 0x41ebbc
call fcn.00403780
mov eax, 0x41eb54
mov edx, 0x40ce44
call fcn.00403780
mov eax, dword [0x41ebbc]
call fcn.004038a4
cmp eax, 5
jge 0x40c8cf
push 0x40cef8
push dword [0x41ebb8]
push 0x40cf0c
lea edx, [ebp - 0x1c0]
xor eax, eax
call fcn.00406434
push dword [ebp - 0x1c0]
lea eax, [ebp - 0x1bc]
mov edx, 4
call fcn.00403964
mov eax, dword [ebp - 0x1bc]
call fcn.00412764
jmp 0x40cdf5
mov eax, dword [0x41ebbc]
call fcn.00403aa4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x1ac], eax
push 0x10
lea eax, [ebp - 0x1b0]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x41d338]
mov eax, dword [eax]
call eax
mov dword [0x41eb8c], eax
cmp dword [0x41eb8c], 0xffffffff
jne 0x40c944
lea edx, [ebp - 0x1c8]
xor eax, eax
call fcn.00406434
mov ecx, dword [ebp - 0x1c8]
lea eax, [ebp - 0x1c4]
mov edx, 0x40cf18
call fcn.004038f0
mov eax, dword [ebp - 0x1c4]
call fcn.00412764
lea eax, [ebp - 4]
call fcn.00406418
jmp 0x40cdf5
mov eax, 0x41eb54
mov edx, 0x40cf2c
call fcn.00403780
push ebp
lea eax, [ebp - 0x1cc]
push eax
xor ecx, ecx
mov dl, 1
xor eax, eax
call fcn.0040c260
pop ecx

Function at 0x40d3dc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x41eb54
mov edx, 0x40d474
call fcn.00403780
push 0
push 0
mov eax, dword [0x41edd4]
call fcn.00403aa4
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x41eb54
mov edx, 0x40d4ac
call fcn.00403780
push 0
push 0
mov eax, dword [0x41edd8]
call fcn.00403aa4
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x41eb54
mov edx, 0x40d534
call fcn.00403780
push 0
push 0
mov eax, dword [0x41eddc]
call fcn.00403aa4
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x41eb54
mov edx, 0x40d580
call fcn.00403780
pop ebp
ret
Function at 0x412764
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x41289b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41eb54
mov edx, 0x4128b4
call fcn.00403780
cmp dword [0x41eb9c], 0
jne 0x4127a5
call fcn.00412690
push 2
push 0
push 0
mov eax, dword [0x41eb9c]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
jne 0x4127c0
call fcn.00412690
mov eax, 0x41eb54
mov edx, 0x4128e0
call fcn.00403780
lea edx, [ebp - 0xc]
mov al, byte [0x41eb96]
call fcn.00405288
push dword [ebp - 0xc]
push 0x4129b0
push dword [ebp - 4]
push 0x4129bc
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403964
mov eax, 0x41eb54
mov edx, 0x4129c8
call fcn.00403780
mov byte [0x41eb96], 0
mov eax, 0x41eb54
mov edx, 0x412a80
call fcn.00403780
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004038a4
test eax, eax
jns 0x412835
call fcn.00402f14
push eax
lea eax, [ebp - 4]
call fcn.00403af4
mov edx, 1
dec edx
test eax, eax
je 0x41284d
cmp edx, dword [eax - 4]
jb 0x412852
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
mov eax, dword [0x41eb9c]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x41286e
mov dword [ebp - 8], 0xffffffff
mov eax, 0x41eb54
mov edx, 0x412af8
call fcn.00403780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4128a2
lea eax, [ebp - 0xc]
call fcn.0040372c
lea eax, [ebp - 4]
call fcn.0040372c
ret

Function at 0x412d20
Capabilities:
Check os version
Get common file path
Get disk information
Get geographical location
Get hostname
Get memory capacity
Get session user name
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xcd
push 0
push 0
dec ecx
jne 0x412d28
xor eax, eax
push ebp
push 0x4143af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41eb54
mov edx, 0x4143c4
call fcn.00403780
mov eax, 0x41eb64
mov edx, 0x414470
call fcn.00403780
mov dword [ebp - 0xf0], 0x94
lea eax, [ebp - 0xf0]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0xe0], 2
jne 0x412d89
lea eax, [ebp - 0x10]
mov edx, 0x41447c
call fcn.004037c4
jmp fcn.00412db1
mov eax, dword [ebp - 0xe0]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5c8]
call fcn.00405168
mov ecx, dword [ebp - 0x5c8]
lea eax, [ebp - 0x10]
mov edx, 0x414498
call fcn.004038f0
Function at 0x417478
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
xor ecx, ecx
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x4178f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41eb54
mov edx, 0x417908
call fcn.00403780
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
call fcn.004038a4
test eax, eax
je 0x4178b9
mov eax, dword [ebp - 8]
call fcn.004038a4
test eax, eax
je 0x4178b9
push 0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_OpenFile
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x41755b
push 0x417930
push dword [ebp - 4]
push 0x417940
lea edx, [ebp - 0xb4]
xor eax, eax
call fcn.00406434
push dword [ebp - 0xb4]
lea eax, [ebp - 0xb0]
mov edx, 4
call fcn.00403964
mov eax, dword [ebp - 0xb0]
call fcn.00412764
jmp 0x4178b9
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetFileSize_1
add eax, 5
jae 0x417570
call fcn.00402f1c
mov dword [ebp - 0x14], eax
mov eax, 0x41eb54
mov edx, 0x41794c
call fcn.00403780
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, dword [0x417458]
call fcn.00404218
add esp, 4
xor eax, eax
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x4175aa
cmp eax, dword [edx - 4]
jb 0x4175af
call fcn.00402f14
lea eax, [edx + eax]
mov edx, 0x41d2e0
mov ecx, 5
call fcn.0040492c
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
sub eax, 5
jae 0x4175d4
call fcn.00402f1c
push eax
mov eax, 5
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x4175e6
cmp eax, dword [edx - 4]
jb 0x4175eb
call fcn.00402f14
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x41763c
push 0x4179fc
push dword [ebp - 4]
push 0x417940
lea edx, [ebp - 0xbc]
xor eax, eax
call fcn.00406434
invalid
mov ch, 0x44
Function at 0x417649
Capabilities:
Write file on windows

Disassembly:
jbe 0x41772c
mov eax, 5
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x417660
cmp eax, dword [edx - 4]
jb 0x417665
call fcn.00402f14
mov al, byte [edx + eax]
cmp al, byte [0x41d2e0]
jne 0x41772c
mov eax, 6
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x417685
cmp eax, dword [edx - 4]
jb 0x41768a
call fcn.00402f14
mov al, byte [edx + eax]
cmp al, byte [0x41d2e1]
jne 0x41772c
mov eax, 7
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x4176aa
cmp eax, dword [edx - 4]
jb 0x4176af
call fcn.00402f14
mov al, byte [edx + eax]
mov eax, dword [ebp - 0x14]
sub eax, 1
jae 0x417739
call fcn.00402f1c
sub eax, 5
jb 0x417811
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 5
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x41775c
cmp eax, dword [edx - 4]
jb 0x417761
call fcn.00402f14
xor byte [edx + eax], 0xc2
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x417774
cmp eax, dword [edx - 4]
jb 0x417779
call fcn.00402f14
movzx eax, byte [edx + eax]
add eax, 0x79
jno 0x417787
call fcn.00402f1c
add eax, 0x8000
cmp eax, 0xffff
jbe 0x417798
call fcn.00402f14
add eax, 0xffff8000
mov word [ebp - 0x1e], ax
cmp word [ebp - 0x1e], 0xff
jle 0x4177dd
movsx eax, word [ebp - 0x1e]
sub eax, 0xff
jno 0x4177b9
call fcn.00402f1c
sub eax, 1
jno 0x4177c3
call fcn.00402f1c
add eax, 0x8000
cmp eax, 0xffff
jbe 0x4177d4
call fcn.00402f14
add eax, 0xffff8000
mov word [ebp - 0x1e], ax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x4177ec
cmp eax, dword [edx - 4]
jb 0x4177f1
call fcn.00402f14
movsx ecx, word [ebp - 0x1e]
cmp ecx, 0xff
jbe 0x417802
call fcn.00402f14
mov byte [edx + eax], cl
inc dword [ebp - 0x18]
dec dword [ebp - 0x24]
jne 0x41774d
mov eax, dword [ebp - 8]
call fcn.004038a4
test eax, eax
jne 0x417828
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004037c4
mov eax, 0x41eb54
mov edx, 0x417a38
call fcn.00403780
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4178b9
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
xor eax, eax
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x417878
cmp eax, dword [edx - 4]
jb 0x41787d
call fcn.00402f14
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x417892
mov byte [ebp - 9], 1
mov eax, 0x41eb54
mov edx, 0x417ab0
call fcn.00403780
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, 0x41eb54
mov edx, 0x417a38
call fcn.00403780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4178f9
lea eax, [ebp - 0xc0]
mov edx, 5
call fcn.00403750
lea eax, [ebp - 0x1c]
mov edx, dword [0x417458]
call fcn.00404224
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403750
ret
Function at 0x417e74
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x417e7c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x418b53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41eb54
mov edx, 0x418b68
call fcn.00403780
lea eax, [ebp - 0xc]
mov ecx, 0x418bbc
mov edx, dword [ebp - 4]
call fcn.004038f0
invalid
inc ebp

Function at 0x4195ac
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 2], dl
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
and eax, 0xff
bt dword [0x41d260], eax
jae 0x4195e5
xor eax, eax
mov al, byte [ebp - 2]
add eax, 1
jno 0x4195d6
call fcn.00402f1c
cmp eax, 0xff
jbe 0x4195e2
call fcn.00402f14
mov byte [ebp - 2], al
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
push 0
xor eax, eax
mov al, byte [ebp - 1]
push eax
call sub.user32.dll_MapVirtualKeyA
cmp eax, 0xff
jbe 0x419606
call fcn.00402f14
push eax
mov al, byte [ebp - 1]
push eax
call sub.user32.dll_keybd_event
pop ecx
pop ebp
ret
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
lea eax, [esp + 4]
push eax
push ecx
push edx
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401062
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401057
cmp dword [esp + 0xc], 4
jne 0x401057
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov bl, 1
mov dword [eax], edx
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0x10
ret

Function at 0x401070
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
mov eax, dword [0x4093f4]
mov dword [esp + 0x98], eax
push ebx
lea eax, [esp + 8]
push eax
xor bl, bl
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4010f2
cmp dword [esp + 0x18], 2
jne 0x4010f2
mov eax, dword [esp + 0xc]
cmp eax, 5
ja 0x4010b5
jne 0x4010f2
cmp dword [esp + 0x10], 1
jb 0x4010f2
mov edx, dword [str.EnablePrefetcher]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [str.SYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters]
push edx
mov edx, 0x80000002
call fcn.00401000
add esp, 8
test al, al
je 0x4010f2
mov al, byte [esp + 4]
and al, 1
pop ebx
mov ecx, dword [esp + 0x98]
call fcn.004032e4
add esp, 0x9c
ret
mov ecx, dword [esp + 0x9c]
mov al, bl
pop ebx
call fcn.004032e4
add esp, 0x9c
ret

Function at 0x401110
Capabilities:
Print debug messages

Disassembly:
sub esp, 0xcc
mov eax, dword [0x4093f4]
mov dword [esp + 0xc8], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x401156
mov eax, dword [esp + 0xd0]
push eax
push str.ADOBE_READLOGGER_CMD:COMMENT:_s
lea ecx, [esp + 8]
push 0xc7
push ecx
call dword [sym.imp.MSVCR71.dll__snprintf]
add esp, 0x10
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0xc8]
call fcn.004032e4
add esp, 0xcc
ret

Function at 0x401390
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4013ac
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 8]
mov dword [esi], ecx
mov eax, dword [esi]
pop esi
add esp, 0x24
ret