joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a844
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov eax, 0x5679a0
push ebx
call fcn.00528424
xor edx, edx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], edx
push eax
push 0x20
xor ebx, ebx
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
jne 0x41a8bf
mov word [ebp - 0x20], 8
xor edx, edx
mov eax, 0x1b5d
mov dword [ebp - 4], edx
lea edx, [ebp - 4]
inc dword [ebp - 0x14]
call fcn.0051100c
cmp dword [ebp - 4], 0
je 0x41a897
mov ecx, dword [ebp - 4]
jmp 0x41a89c
mov ecx, 0x56781d
push ecx
call sub.KERNEL32.DLL_GetLastError
mov edx, eax
pop eax
call fcn.0044a7e0
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005378b8
jmp 0x41a98e
lea ecx, [ebp - 0x40]
push ecx
push 0x56781e
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
test eax, eax
jne 0x41a91e
mov word [ebp - 0x20], 0x14
xor eax, eax
lea edx, [ebp - 8]
mov dword [ebp - 8], eax
mov eax, 0x1b5e
inc dword [ebp - 0x14]
call fcn.0051100c
cmp dword [ebp - 8], 0
je 0x41a8f9
mov edx, dword [ebp - 8]
jmp 0x41a8fe
mov edx, 0x56782f
push edx
call sub.KERNEL32.DLL_GetLastError
mov edx, eax
pop eax
call fcn.0044a7e0
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.005378b8
jmp 0x41a98e
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x44], 1
push 0
push 0
push 0
lea ecx, [ebp - 0x44]
push ecx
push 0
mov eax, dword [ebp - 0x34]
push eax
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
test eax, eax
jne 0x41a98e
mov word [ebp - 0x20], 0x20
xor edx, edx
mov eax, 0x1b5f
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0xc]
inc dword [ebp - 0x14]
call fcn.0051100c
cmp dword [ebp - 0xc], 0
je 0x41a96b
mov ecx, dword [ebp - 0xc]
jmp 0x41a970
mov ecx, 0x567830
push ecx
call sub.KERNEL32.DLL_GetLastError
mov edx, eax
pop eax
call fcn.0044a7e0
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.005378b8
cmp dword [ebp - 0x34], 0
je 0x41a99d
mov ecx, dword [ebp - 0x34]
push ecx
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d7d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov eax, 0x568254
call fcn.00528424
mov dword [ebp - 0x2c], 0x100
mov dword [ebp - 0x30], 0x100
push dword [ebp - 0x30]
call fcn.005269a8
pop ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x41d845
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x100
jbe 0x41d845
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.005269c8
add esp, 8
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x41d845
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
mov word [ebp - 0x18], 8
mov word [ebp - 0x18], 0x14
cmp dword [ebp - 0x30], 0
je 0x41d862
cmp dword [ebp - 0x34], 0
je 0x41d862
mov edx, dword [ebp - 0x34]
jmp 0x41d867
mov edx, 0x567ec8
lea eax, [ebp - 4]
call fcn.00537758
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x20
push dword [ebp - 0x34]
call fcn.005269b8
pop ecx
mov word [ebp - 0x18], 0x2c
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.005378e8
mov eax, dword [ebp + 8]
mov word [ebp - 0x18], 0x38
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005378b8
pop eax
mov word [ebp - 0x18], 0x20
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x41d8e5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x424d58
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 1]
call fcn.00424dac
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x424d7a
lea eax, [ebp - 1]
xor edx, edx
call fcn.00424de0
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x424d90
lea eax, [ebp - 1]
mov dl, 2
call fcn.00424de0
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x424da6
lea eax, [ebp - 1]
mov dl, 1
call fcn.00424de0
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret
Function at 0x4253dc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [0x59bf1c]
mov eax, dword [eax]
call fcn.004c2770
push 0
mov edx, dword [0x59bf1c]
mov ecx, dword [edx]
push dword [ecx + 0x30]
call sub.USER32.DLL_ShowWindow
mov eax, dword [ebp - 4]
cmp word [eax + 0x24a], 0
je 0x425424
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24c]
call dword [ebx + 0x248]
pop ebx
pop ecx
pop ebp
ret

Function at 0x425428
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [0x59bf1c]
mov eax, dword [eax]
call fcn.004c2820
push 9
mov edx, dword [0x59bf1c]
mov ecx, dword [edx]
push dword [ecx + 0x30]
call sub.USER32.DLL_ShowWindow
mov eax, dword [0x59bf1c]
mov edx, dword [eax]
push dword [edx + 0x30]
call sub.USER32.DLL_SetForegroundWindow
mov ecx, dword [ebp - 4]
cmp word [ecx + 0x252], 0
je 0x42547f
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x254]
call dword [ebx + 0x250]
pop ebx
pop ecx
pop ebp
ret
Function at 0x43337c
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebx
push 8
push 1
push 0x56eca7
push 0x56ec9e
push 0x56ec88
call sub.ADVAPI32.DLL_CryptAcquireContextA
mov ebx, eax
test ebx, ebx
jne 0x4333c1
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x8009000f
jne 0x4333c1
push 0
push 1
push 0x56ecdb
push 0x56ecd2
push 0x56ec88
call sub.ADVAPI32.DLL_CryptAcquireContextA
mov ebx, eax
mov eax, ebx
pop ebx
ret

Function at 0x4333f0
Capabilities:
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov edx, eax
mov ecx, eax
shr edx, 6
mov esi, dword [ebp + 0x14]
shr ecx, 0xe
mov byte [ebp - 0x18], dl
mov byte [ebp - 0x17], cl
mov ecx, 2
lea edx, [ebp - 0x16]
and eax, 0x3f
mov bl, byte [esi + eax]
inc eax
mov byte [edx], bl
inc edx
and eax, 0x3f
inc ecx
cmp ecx, 0x10
jl 0x43341d
lea eax, [ebp - 4]
mov edx, dword [0x56ec88]
push eax
push 0
push 0
push 0x8003
push edx
call sub.ADVAPI32.DLL_CryptCreateHash
push 0
lea ecx, [ebp - 0x18]
push 0x10
push ecx
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_CryptHashData
lea edx, [ebp - 8]
mov eax, dword [0x56ec88]
push edx
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x6602
push eax
call sub.ADVAPI32.DLL_CryptDeriveKey
cmp dword [ebp + 0x18], 0
je 0x433491
push 0x40
mov edx, dword [ebp + 0xc]
push edx
push edi
push 0
push 1
push 0
mov ecx, dword [ebp - 8]
push ecx
call sub.ADVAPI32.DLL_CryptEncrypt
mov ebx, eax
jmp 0x4334a7
mov eax, dword [ebp + 0xc]
push eax
push edi
push 0
push 1
push 0
mov edx, dword [ebp - 8]
push edx
call sub.ADVAPI32.DLL_CryptDecrypt
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_CryptDestroyKey
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_CryptDestroyHash
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4363a0
Capabilities:
Encode data using xor
Get disk size
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov ebx, dword [ebp + 8]
call sub.USER32.DLL_GetClipboardOwner
xor dword [ebx + 4], eax
call sub.KERNEL32.DLL_GetCurrentProcess
xor dword [ebx + 8], eax
call sub.KERNEL32.DLL_GetCurrentProcessId
xor dword [ebx + 0xc], eax
call sub.KERNEL32.DLL_GetCurrentThread
xor dword [ebx + 0x10], eax
push ebx
call fcn.00436498
pop ecx
call sub.KERNEL32.DLL_GetCurrentThreadId
xor dword [ebx + 4], eax
call sub.USER32.DLL_GetDesktopWindow
xor dword [ebx + 8], eax
call sub.KERNEL32.DLL_GetProcessHeap
xor dword [ebx + 0xc], eax
call sub.KERNEL32.DLL_GetTickCount
xor dword [ebx + 0x10], eax
push ebx
call fcn.00436498
pop ecx
lea eax, [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov edx, dword [ebp - 0x1c]
xor dword [ebx + 4], edx
mov ecx, dword [ebp - 0x14]
xor dword [ebx + 8], ecx
mov eax, dword [ebp - 0xc]
xor dword [ebx + 0xc], eax
mov edx, dword [ebp - 4]
xor dword [ebx + 0x10], edx
push ebx
call fcn.00436498
pop ecx
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x20]
push ecx
push eax
push edx
push 0
call sub.KERNEL32.DLL_GetDiskFreeSpaceExA
xor eax, eax
lea ecx, [ebx + 4]
lea edx, [ebp - 0x20]
mov esi, dword [edx]
xor dword [ecx], esi
inc eax
add ecx, 4
add edx, 4
cmp eax, 4
jl 0x43643c
push ebx
call fcn.00436498
pop ecx
lea eax, [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_GetSystemTime
xor eax, eax
lea ecx, [ebx + 4]
lea edx, [ebp - 0x20]
mov esi, dword [edx]
xor dword [ecx], esi
inc eax
add ecx, 4
add edx, 4
cmp eax, 4
jl 0x436464
push ebx
call fcn.00436498
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437a5c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov eax, 0x56fb44
push ebx
call fcn.00528424
xor edx, edx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], edx
push eax
push 0x20
xor ebx, ebx
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
jne 0x437ad7
mov word [ebp - 0x20], 8
xor edx, edx
mov eax, 0x1b5d
mov dword [ebp - 4], edx
lea edx, [ebp - 4]
inc dword [ebp - 0x14]
call fcn.0051100c
cmp dword [ebp - 4], 0
je 0x437aaf
mov ecx, dword [ebp - 4]
jmp 0x437ab4
mov ecx, 0x56f99f
push ecx
call sub.KERNEL32.DLL_GetLastError
mov edx, eax
pop eax
call fcn.0044a7e0
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005378b8
jmp 0x437ba6
lea ecx, [ebp - 0x40]
push ecx
push str.SeDebugPrivilege
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
test eax, eax
jne 0x437b36
mov word [ebp - 0x20], 0x14
xor eax, eax
lea edx, [ebp - 8]
mov dword [ebp - 8], eax
mov eax, 0x1b5e
inc dword [ebp - 0x14]
call fcn.0051100c
cmp dword [ebp - 8], 0
je 0x437b11
mov edx, dword [ebp - 8]
jmp 0x437b16
mov edx, 0x56f9b1
push edx
call sub.KERNEL32.DLL_GetLastError
mov edx, eax
pop eax
call fcn.0044a7e0
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.005378b8
jmp 0x437ba6
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x44], 1
push 0
push 0
push 0
lea ecx, [ebp - 0x44]
push ecx
push 0
mov eax, dword [ebp - 0x34]
push eax
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
test eax, eax
jne 0x437ba6
mov word [ebp - 0x20], 0x20
xor edx, edx
mov eax, 0x1b5f
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0xc]
inc dword [ebp - 0x14]
call fcn.0051100c
cmp dword [ebp - 0xc], 0
je 0x437b83
mov ecx, dword [ebp - 0xc]
jmp 0x437b88
mov ecx, 0x56f9b2
push ecx
call sub.KERNEL32.DLL_GetLastError
mov edx, eax
pop eax
call fcn.0044a7e0
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.005378b8
cmp dword [ebp - 0x34], 0
je 0x437bb5
mov ecx, dword [ebp - 0x34]
push ecx
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439f70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
mov byte [ebp - 8], dl
test dl, dl
jle 0x439f83
call fcn.005380a4
mov ebx, ecx
mov byte [ebp - 0x29], dl
mov dword [ebp - 4], eax
mov eax, 0x572830
call fcn.00528424
mov word [ebp - 0x18], 8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0050bdf0
add dword [ebp - 0xc], 2
mov edx, dword [ebp - 4]
mov byte [edx + 0x30], bl
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [ecx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, 0x44
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, 0x48
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, 0x4c
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov byte [ecx + 0xf], 1
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
mov eax, dword [ebp - 4]
cmp byte [ebp - 0x29], 0
je 0x43a00c
call fcn.005380b1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x448b7c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
mov ebx, eax
lea esi, [ebp - 0x3c]
mov eax, 0x57835c
call fcn.00528424
mov dword [ebp - 0x40], 0x40
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x80]
push ecx
call sub.KERNEL32.DLL_GetComputerNameA
test eax, eax
je 0x448ca9
lea edx, [ebp - 0x80]
lea eax, [ebp - 8]
call fcn.00537758
inc dword [esi + 0x1c]
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
mov word [esi + 0x10], 8
mov edx, ebx
call fcn.00537758
inc dword [esi + 0x1c]
pop edx
call fcn.005379cc
test eax, eax
je 0x448c7e
lea edx, [ebp - 0x80]
lea eax, [ebp - 0x14]
call fcn.00537758
inc dword [esi + 0x1c]
lea ecx, [ebp - 0x14]
push ecx
mov edx, 0x57619a
lea eax, [ebp - 0x10]
call fcn.00537758
inc dword [esi + 0x1c]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
inc dword [esi + 0x1c]
pop edx
call fcn.00537910
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00537758
inc dword [esi + 0x1c]
pop edx
call fcn.005379cc
test eax, eax
mov edx, 2
sete al
and eax, 1
push eax
lea eax, [ebp - 0x18]
dec dword [esi + 0x1c]
call fcn.005378b8
dec dword [esi + 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.005378b8
dec dword [esi + 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.005378b8
dec dword [esi + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.005378b8
pop ecx
test ecx, ecx
jne 0x448c7e
xor eax, eax
jmp 0x448c83
mov eax, 1
push eax
dec dword [esi + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.005378b8
dec dword [esi + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005378b8
pop ecx
test ecx, ecx
jne 0x448cad
xor eax, eax
jmp 0x448cb2
mov eax, 1
mov edx, dword [esi]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44987c
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, 0x5786e4
call fcn.00528424
mov dword [ebp - 0x70], 1
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x58], ecx
lea edx, [ebp - 0x74]
mov eax, dword [ebp + 8]
push eax
push ebx
push esi
push edx
call sub.MPR.DLL_WNetAddConnection2A
mov ebx, eax
test ebx, ebx
je 0x4499de
cmp byte [ebp + 0xc], 0
je 0x4499de
mov word [ebp - 0x2c], 8
xor ecx, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ecx
push eax
inc dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, edi
call fcn.00537758
inc dword [ebp - 0x20]
mov edx, dword [eax]
lea eax, [ebp - 0x48]
call fcn.00406a44
push 0
push 0
push 0x406aa0
mov ecx, 1
push 3
mov dword [ebp - 0xc], ecx
push ecx
push 8
push 0
call fcn.005265ac
mov dword [ebp - 0x10], eax
add esp, 0x1c
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
mov dword [esi], eax
lea eax, [ebp - 0x10]
mov dl, byte [ebp - 0x44]
mov byte [esi + 4], dl
inc dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
xor eax, eax
mov ecx, dword [edx]
lea edx, [ebp - 4]
push ecx
mov dword [ebp - 4], eax
inc dword [ebp - 0x20]
mov eax, 0x4a3d
call fcn.0051100c
lea edx, [ebp - 4]
lea eax, [ebp - 0x14]
mov ecx, dword [edx]
mov edx, edi
push ecx
call fcn.00537758
inc dword [ebp - 0x20]
mov edx, dword [eax]
lea eax, [ebp - 0x50]
call fcn.00406a44
mov ecx, 1
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp - 0x54]
dec ecx
pop eax
pop edx
call fcn.00511db4
cmp dword [ebp - 0x18], 0
je 0x449985
mov eax, dword [ebp - 0x18]
jmp 0x44998a
mov eax, 0x5761eb
mov edx, ebx
call fcn.0044a7e0
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.005378b8
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.005378b8
dec dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00526184
pop ecx
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.005378b8
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005378b8
test ebx, ebx
sete al
and eax, 1
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46f084
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x10
mov ecx, ebx
mov eax, esi
shr eax, cl
xor esi, eax
mov ecx, 2
mov eax, ebx
xor edx, edx
div ecx
mov ebx, eax
test ebx, ebx
ja 0x46f091
mov eax, esi
and eax, 1
pop esi
pop ebx
pop ebp
ret
Function at 0x4799a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
mov byte [ebp - 8], dl
test dl, dl
jle 0x4799b3
call fcn.005380a4
mov ebx, ecx
mov byte [ebp - 0x29], dl
mov dword [ebp - 4], eax
mov eax, 0x58aa9c
call fcn.00528424
mov word [ebp - 0x18], 8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0050bdf0
add dword [ebp - 0xc], 2
mov edx, dword [ebp - 4]
mov byte [edx + 0x30], bl
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x34], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
add eax, 0x38
call fcn.00537790
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov byte [ecx + 0xf], 1
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
mov eax, dword [ebp - 4]
cmp byte [ebp - 0x29], 0
je 0x479a19
call fcn.005380b1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4833fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
mov dl, byte [esi + 0x100]
mov al, byte [esi + 0x101]
mov byte [ebp - 1], al
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0x10]
mov ecx, eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jge 0x483471
inc edx
xor ecx, ecx
and edx, 0xff
xor ebx, ebx
mov al, byte [esi + edx]
add byte [ebp - 1], al
mov cl, byte [ebp - 1]
mov cl, byte [esi + ecx]
mov byte [esi + edx], cl
mov bl, byte [ebp - 1]
mov byte [esi + ebx], al
add al, cl
mov ecx, dword [ebp - 0xc]
and eax, 0xff
mov al, byte [esi + eax]
mov cl, byte [ecx]
xor cl, al
mov eax, dword [ebp - 0xc]
mov byte [eax], cl
inc dword [ebp - 8]
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jl 0x48342d
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x483a8c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov ecx, 0x3020100
push ebx
push esi
push edi
mov edx, dword [ebp + 8]
mov dword [edx], ecx
add ecx, 0x4040404
inc eax
add edx, 4
cmp eax, 0x40
jl 0x483a9f
mov eax, dword [ebp + 8]
mov byte [eax + 0x100], 0
mov ecx, dword [ebp + 8]
xor eax, eax
mov byte [ecx + 0x101], 0
xor ecx, ecx
xor edx, edx
mov dword [ebp - 4], edx
mov edx, dword [ebp + 8]
mov esi, edx
mov ebx, dword [ebp + 0xc]
mov dl, byte [esi]
and ecx, 0xff
mov bl, byte [ebx + eax]
mov byte [ebp - 5], bl
xor ebx, ebx
mov bl, byte [ebp - 5]
add ecx, ebx
xor ebx, ebx
mov bl, dl
add ecx, ebx
and ecx, 0x800000ff
jns 0x483b00
dec ecx
or ecx, 0xffffff00
inc ecx
xor ebx, ebx
mov bl, cl
mov edi, dword [ebp + 8]
mov bl, byte [edi + ebx]
mov byte [esi], bl
xor ebx, ebx
mov bl, cl
mov edi, dword [ebp + 8]
mov byte [edi + ebx], dl
inc eax
cmp eax, dword [ebp + 0x10]
jne 0x483b1e
xor eax, eax
inc dword [ebp - 4]
inc esi
cmp dword [ebp - 4], 0x100
jl 0x483ad2
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x483ebc
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0x58
push 0
push ebx
call fcn.00527dec
mov dword [ebx + 8], 0x67452301
mov dword [ebx + 0xc], 0xefcdab89
mov dword [ebx + 0x10], 0x98badcfe
mov dword [ebx + 0x14], 0x10325476
xor eax, eax
add esp, 0xc
xor edx, edx
mov dword [ebx], eax
mov dword [ebx], edx
pop ebx
pop ebp
ret

Function at 0x48a484
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x68], 0
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x48c408
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x48c354
call sub.USER32.DLL_EnumWindows
ret

Function at 0x48c52c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x48c5a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0048bf78
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
push 0
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x48c551
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0048bbd0
cmp dword [ebp - 4], 0
je 0x48c593
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00524218
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.USER32.DLL_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c5b0
lea eax, [ebp - 4]
call fcn.00523d68
ret
Function at 0x49dab0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00523d68
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x49daff
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00523fd0
pop ebx
mov esp, ebp
pop ebp
ret