joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x471afa
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 8]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x471afa
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp edx, eax
je 0x471b0f
mov eax, dword [esp]
test eax, eax
je 0x471b09
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 0x18
mov eax, dword [esp]
test eax, eax
je 0x471b1e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret 0x18

Function at 0x471b30
Capabilities:
Set registry value

Disassembly:
push ecx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x18]
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x471b89
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x471b9e
mov eax, dword [esp]
test eax, eax
je 0x471b98
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 0x18
mov eax, dword [esp]
test eax, eax
je 0x471bad
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret 0x18

Function at 0x471bc0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push esi
test ecx, ecx
mov dword [esp + 4], 0
je 0x471c2b
mov eax, dword [esp + 0x10]
test eax, eax
je 0x471c2b
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x471bf4
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
pop esi
inc eax
pop ecx
ret 0xc
lea edx, [esp + 4]
push edx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x471c1c
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x471c32
mov eax, dword [esp + 4]
test eax, eax
je 0x471c2b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ecx
ret 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x471c41
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ecx
ret 0xc
Function at 0x471c50
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x398
mov eax, dword [esp + 0x39c]
push esi
test eax, eax
push edi
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x378
je 0x471ddb
mov ecx, dword [esp + 0x3a8]
test ecx, ecx
je 0x471ddb
mov edi, dword [esp + 0x3ac]
test edi, edi
je 0x471ddb
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x471ddb
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x471d9c
cmp dword [esp + 0xc], 0x378
jne 0x471d9c
lea eax, [esp + 0x28]
push eax
push edi
call fcn.00482190
add esp, 8
test eax, eax
je 0x471dbc
cmp dword [esp + 0x154], 1
jne 0x471dbc
cmp dword [esp + 0x178], 2
jne 0x471dbc
mov ecx, dword [esp + 0x150]
lea edx, [esp + 0x10]
push ecx
push 0x5ac400
push edx
call fcn.00481ec6
mov eax, dword [esp + 0x18]
add esp, 0xc
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
push eax
push ecx
push edx
mov ecx, esi
call fcn.00471b30
test eax, eax
je 0x471d9c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x28]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xc]
push ecx
push edx
push 3
push 0
push str.PackedCatalogItem
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x471daf
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
test eax, eax
je 0x471da6
push eax
call esi
jmp 0x471da2
mov eax, dword [esp + 0x3b0]
test eax, eax
je 0x471dbc
inc dword [eax]
mov eax, dword [esp + 8]
test eax, eax
je 0x471dcb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x398
ret 0x10
pop edi
xor eax, eax
pop esi
add esp, 0x398
ret 0x10
Function at 0x471df0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x39c
mov eax, dword [esp + 0x3a0]
push esi
push edi
mov edi, ecx
test eax, eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x378
je 0x471f5c
mov ecx, dword [esp + 0x3ac]
test ecx, ecx
je 0x471f5c
mov edx, dword [esp + 0x3b0]
test edx, edx
je 0x471f5c
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call esi
test eax, eax
jne 0x471f5c
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x471f40
cmp dword [esp + 0x10], 0x378
jne 0x471f40
cmp dword [esp + 0x158], 1
jne 0x471f69
cmp dword [esp + 0x17c], 2
jne 0x471f69
mov eax, dword [esp + 0x154]
lea ecx, [esp + 0x14]
push eax
push 0x5ac400
push ecx
call fcn.00481ec6
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x471f40
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, edi
call fcn.00471fa0
test eax, eax
je 0x471f40
mov edx, dword [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, edi
call fcn.00471aa0
test eax, eax
je 0x471f40
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x2c]
push edx
push eax
push 3
push 0
push str.PackedCatalogItem
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x471f69
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x471f51
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x471f5c
push eax
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x39c
ret 0xc
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x471f7a
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x471f85
push eax
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x39c
ret 0xc
Function at 0x471fa0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x480
mov ecx, dword [esp + 0x484]
mov dword [esp], 0x378
test ecx, ecx
je 0x472061
mov eax, dword [esp + 0x488]
test eax, eax
je 0x472061
lea edx, [esp]
push edx
lea edx, [esp + 0x10c]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x472061
cmp dword [esp], 0x378
jne 0x472061
lea eax, [esp + 4]
push 0x104
lea ecx, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x472061
lea edx, [esp + 4]
push edx
call fcn.00471a30
add esp, 4
test eax, eax
je 0x472061
cmp dword [esp + 0x234], 1
jne 0x472053
cmp dword [esp + 0x258], 2
jne 0x472053
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x472061
push str.WSPStartup
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x472061
mov eax, 1
add esp, 0x480
ret 8
xor eax, eax
add esp, 0x480
ret 8

Function at 0x472070
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
je 0x4720cf
push esi
call fcn.00471a30
add esp, 4
test eax, eax
je 0x4720cf
lea eax, [esp + 4]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x4720cf
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4720cf
push 0x5ac424
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x104
ret 4
xor eax, eax
pop esi
add esp, 0x104
ret 4
Function at 0x472160
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x472194
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.00472070
test eax, eax
jne 0x4721ad
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.004720e0
cmp eax, 1
je 0x47233a
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4721e6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x472262
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4722e2
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.00471fa0
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x4722f9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x472202
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x4722b0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.00471c50
test eax, eax
je 0x4722e2
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x47227e
cmp dword [esp + 0x18], 1
jb 0x4722e2
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.00471b30
cmp eax, 1
je 0x47232b
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x472309
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x4722e2
push ebp
mov ecx, ebx
call fcn.00472350
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47233a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x472350
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x472382
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.004720e0
test eax, eax
jne 0x47239f
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4723c6
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x472414
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.00471df0
test eax, eax
jne 0x4723fd
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x4723e3
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
call fcn.00471bc0
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x472437
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4

Function at 0x493d07
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x493d3f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00491d91
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00491d69
jmp 0x493d4b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4953f5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x495437
call fcn.0049b1ad
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x495437
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49542e
xor eax, eax
jmp 0x49543f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00495445
pop edi
pop esi
pop ebx
ret 4
Function at 0x49b6dd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49b70b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49b729
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049b643
jmp 0x49b729
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49b729
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049b643
test edi, edi
mov eax, edi
jne 0x49b713
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0xbff80990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [eax]
mov ebx, dword [ecx]
push edi
lea edi, [esi + 0x1000]
mov dword [ebp + 8], 0x10
xor eax, dword [edi]
push eax
push esi
mov dword [ebp - 4], eax
call fcn.bff809ed
pop ecx
xor eax, ebx
mov ebx, dword [ebp - 4]
add edi, 4
dec dword [ebp + 8]
pop ecx
jne 0xbff809b1
mov edx, dword [ebp + 0xc]
mov ecx, eax
mov eax, dword [esi + 0x1040]
pop edi
xor eax, ecx
mov ecx, dword [esi + 0x1044]
xor ecx, ebx
pop esi
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
pop ebx
mov dword [ecx], eax
leave
ret

Function at 0xbff80b63
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [eax]
mov ebx, dword [ecx]
push edi
lea edi, [esi + 0x1044]
mov dword [ebp + 8], 0x10
xor eax, dword [edi]
push eax
push esi
mov dword [ebp - 4], eax
call fcn.bff809ed
pop ecx
xor eax, ebx
mov ebx, dword [ebp - 4]
sub edi, 4
dec dword [ebp + 8]
pop ecx
jne 0xbff80b84
mov edx, dword [ebp + 0xc]
mov ecx, eax
mov eax, dword [esi + 0x1004]
pop edi
xor eax, ecx
mov ecx, dword [esi + 0x1000]
xor ecx, ebx
pop esi
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
pop ebx
mov dword [ecx], eax
leave
ret
Function at 0xbff80ec1
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 8]
push edi
shl esi, 0x18
shr eax, 8
or esi, eax
mov edi, esi
mov eax, esi
shl edi, 0x18
shr eax, 8
or edi, eax
mov dword [ebp - 4], esi
mov eax, edi
mov ecx, edi
shl eax, 0x18
shr ecx, 8
or eax, ecx
mov ecx, dword [ebp + 0x10]
shr ecx, 2
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
and ecx, 0x3ffffffe
cmp byte [ebp + 0x14], 0
mov dword [ebp - 0x10], edi
lea ecx, [eax + ecx*4]
mov dword [ebp - 0xc], ecx
je 0xbff80f8c
cmp eax, ecx
jae 0xbff80ffa
jmp 0xbff80f20
mov esi, dword [ebp - 4]
mov ecx, dword [eax]
and dword [ebp + 0x14], 0
lea edx, [eax + 4]
mov dword [ebp + 0x10], 0x20
mov dword [ebp + 0xc], edx
mov edx, dword [edx]
jmp 0xbff80f3a
mov esi, dword [ebp - 4]
mov edi, edx
sub dword [ebp + 0x14], 0x61c88647
shr edi, 5
add edi, esi
mov esi, edx
shl esi, 4
add esi, dword [ebp + 8]
xor edi, esi
mov esi, dword [ebp + 0x14]
add esi, edx
xor edi, esi
add ecx, edi
mov esi, ecx
mov edi, ecx
shr esi, 5
add esi, dword [ebp - 8]
shl edi, 4
add edi, dword [ebp - 0x10]
xor esi, edi
mov edi, dword [ebp + 0x14]
add edi, ecx
xor esi, edi
add edx, esi
dec dword [ebp + 0x10]
jne 0xbff80f37
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
add eax, 4
cmp eax, dword [ebp - 0xc]
jb 0xbff80f1d
jmp 0xbff80ffa
cmp eax, ecx
jae 0xbff80ffa
push ebx
mov edx, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], 0xc6ef3720
mov ecx, dword [ecx]
mov dword [ebp + 0x10], 0x20
mov esi, edx
mov ebx, edx
shr esi, 5
add esi, dword [ebp - 8]
shl ebx, 4
add ebx, edi
xor esi, ebx
mov ebx, dword [ebp + 0x14]
add ebx, edx
xor esi, ebx
sub ecx, esi
mov esi, ecx
mov ebx, ecx
shr esi, 5
add esi, dword [ebp - 4]
shl ebx, 4
add ebx, dword [ebp + 8]
xor esi, ebx
mov ebx, dword [ebp + 0x14]
add dword [ebp + 0x14], 0x61c88647
add ebx, ecx
xor esi, ebx
sub edx, esi
dec dword [ebp + 0x10]
jne 0xbff80fa9
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
add eax, 4
cmp eax, dword [ebp - 0xc]
jb 0xbff80f91
pop ebx
pop edi
pop esi
leave
ret

Function at 0xbff81bcc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
mov eax, dword [edi + 0x3c]
mov esi, dword [eax + edi + 0x78]
mov eax, dword [esi + edi + 0x20]
add esi, edi
add eax, edi
mov ebx, dword [esi + 0x24]
mov ecx, dword [esi + 0x1c]
add ebx, edi
add ecx, edi
cmp dword [esi + 0x18], 0
mov dword [ebp - 8], ecx
jbe 0xbff81c25
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov eax, dword [eax]
add eax, edi
push eax
call fcn.bff87780
pop ecx
test eax, eax
pop ecx
je 0xbff81c2c
inc dword [ebp + 8]
add dword [ebp - 4], 4
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x18]
jb 0xbff81c00
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
movzx eax, word [ebx + eax*2]
mov eax, dword [ecx + eax*4]
add eax, edi
jmp 0xbff81c27
Function at 0xbff820d3
Capabilities:
Check for time delay via gettickcount
Create thread
Hide graphical window
Log keystrokes via polling
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov ecx, dword [ebp + 8]
mov al, byte [ebp + 0x14]
cmp byte [ebp + 0x18], 0
push ebx
mov bl, byte [ebp + 0x10]
mov dword [0xbff93ad8], ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov byte [0xbff93aec], al
mov byte [0xbff93aed], bl
mov dword [0xbff93ad4], ecx
je 0xbff8215a
test al, al
jne 0xbff8215a
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0xbff93af9], 1
call edi
mov esi, eax
xor eax, eax
push 0xbff93af0
push eax
push eax
push 0xbff8247e
push eax
push eax
add esi, 0xfa
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [0xbff93af9], 0
je 0xbff82152
call edi
cmp eax, esi
jae 0xbff82152
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0xbff82139
push 1
pop eax
jmp 0xbff822d0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp byte [0xbff93af8], 0
mov dword [0xbff93af0], eax
jne 0xbff821d3
mov eax, dword [0xbff93780]
xor esi, esi
mov dword [ebp - 0x18], eax
mov al, byte [0xbff93aec]
neg al
sbb eax, eax
mov dword [ebp - 0x28], esi
and al, 0xfe
mov dword [ebp - 0x24], 0xbff822d5
add eax, 0x7f02
mov dword [ebp - 0x20], esi
push eax
push esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.USER32.dll_LoadCursorA]
cmp byte [ebp + 0x14], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], 0xbff904b4
jne 0xbff821c0
mov dword [ebp - 4], 0xbff9049c
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
mov byte [0xbff93af8], 1
jmp 0xbff821d5
xor esi, esi
cmp byte [ebp + 0x14], 0
je 0xbff821ed
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
inc edi
cmp edi, 0x100
jl 0xbff821dd
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
call esi
sub eax, dword [0xbff93ad8]
push 1
cdq
sub eax, edx
mov edi, eax
sar edi, 1
call esi
mov ecx, dword [0xbff93ad4]
sub eax, ecx
cdq
sub eax, edx
mov edx, 0xbff904b4
sar eax, 1
cmp byte [ebp + 0x14], 0
jne 0xbff82224
mov edx, 0xbff9049c
xor esi, esi
push esi
push dword [0xbff93780]
push esi
push esi
push ecx
push dword [0xbff93ad8]
push eax
mov al, byte [0xbff93aec]
neg al
sbb eax, eax
push edi
and eax, 0xf8000000
add eax, 0x8000000
or eax, 0x80000000
neg bl
sbb ebx, ebx
push eax
and ebx, 0xffffff88
push esi
add ebx, 0x80
push edx
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 4
push eax
mov dword [0xbff93ae0], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0xbff93ae0]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp byte [ebp + 0x14], 0
je 0xbff82298
push esi
push 0x64
push 2
push dword [0xbff93ae0]
call dword [sym.imp.USER32.dll_SetTimer]
push dword [0xbff93ae0]
lea eax, [ebp - 0x128]
push 0xbff90448
push eax
call fcn.bff8318b
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
push 0xbff9048c
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
and byte [0xbff93af9], 0
mov eax, dword [0xbff93ae0]
pop edi
pop esi
pop ebx
leave
ret