joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a1708
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, 0x100
push edi
mov ebx, eax
or esi, eax
shl dword [ebp + 0x10], 1
mov eax, esi
shr eax, 7
and eax, 1
push eax
mov eax, ebx
and eax, dword [ebp + 0x10]
mov ecx, esi
add eax, ebx
shr ecx, 8
add ecx, eax
mov eax, dword [ebp + 0xc]
lea edi, [eax + ecx*2]
mov eax, dword [ebp + 8]
call fcn.004a1678
add esi, esi
mov eax, esi
xor eax, dword [ebp + 0x10]
pop ecx
not eax
and ebx, eax
cmp esi, 0x10000
jb 0x4a171b
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a175c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
or ecx, 0x100
push esi
mov esi, dword [ebp + 8]
mov edx, ecx
shr edx, 8
movzx edx, word [esi + edx*2]
mov esi, ecx
shr esi, 7
and esi, 1
neg esi
sar esi, 4
and esi, 0x7f
shr edx, 4
xor edx, esi
mov esi, dword [ebp + 0xc]
add eax, dword [esi + edx*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x4a176a
pop esi
pop ebp
ret

Function at 0x4a179e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, 0x100
push esi
xor eax, eax
or edx, ecx
push edi
shl dword [ebp + 0xc], 1
mov esi, ecx
and esi, dword [ebp + 0xc]
mov edi, edx
add esi, ecx
shr edi, 8
add edi, esi
mov esi, dword [ebp + 8]
movzx esi, word [esi + edi*2]
mov edi, edx
shr edi, 7
and edi, 1
neg edi
shr esi, 4
sar edi, 4
and edi, 0x7f
xor esi, edi
mov edi, dword [ebp + 0x10]
add eax, dword [edi + esi*4]
add edx, edx
mov esi, edx
xor esi, dword [ebp + 0xc]
not esi
and ecx, esi
cmp edx, 0x10000
jb 0x4a17ae
pop edi
pop esi
pop ebp
ret

Function at 0x4a18ae
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor edx, edx
push esi
mov esi, eax
xor eax, eax
inc edx
test esi, esi
je 0x4a18ef
push ebx
push edi
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
movzx edi, word [edi + edx*2]
shr dword [ebp + 0xc], 1
and ecx, 1
mov ebx, ecx
neg ebx
sar ebx, 4
and ebx, 0x7f
shr edi, 4
xor edi, ebx
mov ebx, dword [ebp + 0x10]
add eax, dword [ebx + edi*4]
add edx, edx
or edx, ecx
dec esi
jne 0x4a18c1
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x4a700d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ecx, ecx
push 4
pop edx
mov dword [eax + 0x34], ecx
mov byte [eax + 0x1f], cl
mov dword [eax + 0x24], ecx
mov dword [eax + 0x30], 0x20
mov byte [eax + 0x1d], 1
mov dword [eax + 0x48], edx
mov byte [eax + 0x1e], cl
xor esi, esi
add eax, 0x60
push 8
mov ecx, esi
pop edi
mov ebx, ecx
and ebx, 1
dec ebx
not ebx
and ebx, 0xedb88320
shr ecx, 1
xor ecx, ebx
dec edi
jne 0x4a7041
mov dword [eax], ecx
inc esi
add eax, edx
cmp esi, 0x100
jb 0x4a703c
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a7e59
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call fcn.004aae8e
mov ecx, dword [ebp + 8]
push eax
mov dword [ecx], eax
call fcn.004a7dfc
add esp, 0x1c
leave
ret
Function at 0x4a9cb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c92fb
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5000f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x20], ebx
xor esi, esi
mov dword [ebp - 4], esi
lea edi, [ebx + 4]
push edi
push esi
push esi
push esi
push esi
push str.FopdMonPort
call sub.FLTLIB.DLL_FilterConnectCommunicationPort
test eax, eax
jne 0x4a9de7
push 4
push esi
push esi
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [ebx + 8], eax
cmp eax, esi
je 0x4a9de7
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x18], esi
mov edi, edi
cmp dword [ebp - 0x18], 2
jae 0x4a9dcb
push 0x2c
call fcn.004ab619
add esp, 4
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x4a9d4a
mov ecx, eax
call fcn.004a9140
mov esi, eax
jmp 0x4a9d4c
xor esi, esi
mov byte [ebp - 4], 0
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp + 8]
mov dword [esi + 0x28], ecx
mov eax, dword [esi]
lea edx, [eax + 0x220]
push edx
push 0x220
push eax
mov eax, dword [edi]
push eax
call sub.FLTLIB.DLL_FilterGetMessage
cmp eax, 0x800703e5
jne 0x4a9dba
mov ecx, dword [edi]
mov dword [esi + 0xc], ecx
mov edx, dword [ebx + 8]
mov dword [esi + 8], edx
mov ecx, esi
call fcn.004a9590
push 0
push 0
push esi
push 0x4a9b80
push 0
push 0
call fcn.004aae8e
add esp, 0x18
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebx + 0xc]
call fcn.004a9340
mov byte [ebp - 0x11], 1
inc dword [ebp - 0x18]
jmp 0x4a9d20
push 1
mov ecx, esi
call fcn.004a9320
inc dword [ebp - 0x18]
jmp 0x4a9d20
cmp byte [ebp - 0x11], 0
je 0x4a9de7
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xffffffff
jmp 0x4a9e00
mov ecx, ebx
call fcn.004a9460
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a9e20
Capabilities:
Get common file path
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4c9341
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5000f4]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x14], ebx
mov edi, dword [esp + 0x34]
mov ecx, edi
call fcn.00404eb0
mov dword [esp + 0x2c], ebx
push 0x800
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0x400
mov byte [esp + 0x24], 1
call fcn.004abbd8
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4a9e9e
push 0x800
push ebx
push esi
call fcn.004ad2a0
add esp, 0xc
mov dword [esp + 0x18], esi
mov dword [esp + 0x2c], 1
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x20]
push ecx
push ebx
push ebx
xor eax, eax
push esi
mov word [esi + 6], ax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov cl, byte [esp + 0x10]
movzx edx, byte [esp + 0x11]
movzx eax, cl
add eax, edx
movzx edx, byte [esp + 0x12]
add eax, edx
movzx edx, byte [esp + 0x13]
add eax, edx
movzx edx, byte [esp + 0x13]
push eax
mov byte [esp + 0x14], dl
movzx edx, byte [esp + 0x16]
mov byte [esp + 0x17], cl
mov cl, byte [esp + 0x15]
push 0x4de8bc
push edi
mov byte [esp + 0x1d], dl
mov byte [esp + 0x1e], cl
call fcn.0041c220
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x44]
push eax
push 0x4de8bc
push ecx
call fcn.0041c220
mov byte [esp + 0x44], bl
push esi
call fcn.004ababb
add esp, 0x1c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x4aa641
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5000f4]
jne 0x4aa64b
repz ret
jmp fcn.004afc94
Function at 0x4ba9bd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004b04ef
and dword [ebp - 4], 0
cmp dword [0x513a10], 0
mov ebx, eax
jne 0x4baa6e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4bab1f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4bab1f
push eax
call fcn.004b047d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x513a10], eax
call esi
push eax
call fcn.004b047d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x513a14], eax
call esi
push eax
call fcn.004b047d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x513a18], eax
call esi
push eax
call fcn.004b047d
pop ecx
mov dword [0x513a20], eax
test eax, eax
je 0x4baa6e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004b047d
pop ecx
mov dword [0x513a1c], eax
mov eax, dword [0x513a1c]
cmp eax, ebx
je 0x4baac6
cmp dword [0x513a20], ebx
je 0x4baac6
push eax
call fcn.004b04f8
push dword [0x513a20]
mov esi, eax
call fcn.004b04f8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4baac6
test edi, edi
je 0x4baac6
call esi
test eax, eax
je 0x4baabd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4baabd
test byte [ebp - 0xc], 1
jne 0x4baac6
or dword [ebp + 0x10], 0x200000
jmp 0x4baaff
mov eax, dword [0x513a14]
cmp eax, ebx
je 0x4baaff
push eax
call fcn.004b04f8
pop ecx
test eax, eax
je 0x4baaff
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4baaff
mov eax, dword [0x513a18]
cmp eax, ebx
je 0x4baaff
push eax
call fcn.004b04f8
pop ecx
test eax, eax
je 0x4baaff
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x513a10]
call fcn.004b04f8
pop ecx
test eax, eax
je 0x4bab1f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4bab21
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4c00c1
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
je 0x4c00cb
or eax, 0xffffffff
ret
cmp dword [esi + 4], 0
jne 0x4c0114
call fcn.004af675
and dword [eax], 0
push dword [esi + 0x40]
push 0x4000
push 1
push dword [esi + 0x44]
call fcn.004c5df0
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x4c010f
push dword [esi + 0x40]
mov dword [esi + 0x3c], 1
call fcn.004c5b1c
pop ecx
test eax, eax
je 0x4c00c7
or dword [esi + 0x38], 0xffffffff
jmp 0x4c00c7
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
dec dword [esi + 4]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
ret
Function at 0x4c0122
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
mov edi, dword [esi + 4]
inc ebx
cmp edi, 2
jae 0x4c0194
test edi, edi
je 0x4c0141
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov al, byte [eax]
mov byte [ecx], al
call fcn.004af675
and dword [eax], 0
push dword [esi + 0x40]
mov ecx, edi
mov eax, 0x4000
sar eax, cl
push eax
mov eax, dword [esi + 0x44]
add eax, edi
push ebx
push eax
call fcn.004c5df0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4c017c
push dword [esi + 0x40]
call fcn.004c5b1c
pop ecx
test eax, eax
je 0x4c017c
or dword [esi + 0x38], 0xffffffff
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x44]
mov dword [esi], ecx
cmp eax, 2
jae 0x4c0194
mov dword [esi + 0x58], eax
jmp 0x4c024d
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x4c024a
cmp byte [eax + 1], 0x8b
jne 0x4c024a
add dword [esi + 4], 0xfffffffe
add eax, 2
mov dword [esi], eax
call fcn.004c00c1
mov edi, eax
call fcn.004c00c1
mov ebx, eax
cmp edi, 8
jne 0x4c0241
test bl, 0xe0
jne 0x4c0241
push 6
pop edi
call fcn.004c00c1
dec edi
jne 0x4c01cd
test bl, 4
je 0x4c01fc
call fcn.004c00c1
mov edi, eax
call fcn.004c00c1
shl eax, 8
add edi, eax
mov eax, edi
dec edi
test eax, eax
je 0x4c01fc
call fcn.004c00c1
cmp eax, 0xffffffff
jne 0x4c01eb
test bl, 8
je 0x4c020f
call fcn.004c00c1
test eax, eax
je 0x4c020f
cmp eax, 0xffffffff
jne 0x4c0201
test bl, 0x10
je 0x4c0222
call fcn.004c00c1
test eax, eax
je 0x4c0222
cmp eax, 0xffffffff
jne 0x4c0214
test bl, 2
je 0x4c0232
push 2
pop edi
call fcn.004c00c1
dec edi
jne 0x4c022a
mov eax, dword [esi + 0x3c]
neg eax
sbb eax, eax
and eax, 0xfffffffd
mov dword [esi + 0x38], eax
jmp 0x4c024d
mov dword [esi + 0x38], 0xfffffffd
jmp 0x4c024d
mov dword [esi + 0x58], ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4c02eb
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4c038d
cmp byte [esi + 0x5c], 0x77
jne 0x4c038d
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [esi], eax
mov dword [esi + 4], ebx
test ebx, ebx
je 0x4c0373
push edi
mov edi, 0x4000
cmp dword [esi + 0x10], 0
jne 0x4c033e
push dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push edi
push 1
push eax
mov dword [esi + 0xc], eax
call fcn.004c5a9a
add esp, 0x10
cmp eax, edi
jne 0x4c036e
mov dword [esi + 0x10], edi
mov eax, dword [esi + 4]
add dword [esi + 0x64], eax
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push 0
push esi
call fcn.004c0a8f
pop ecx
pop ecx
mov ecx, dword [esi + 4]
sub dword [esi + 0x64], ecx
mov ecx, dword [esi + 0x10]
sub dword [esi + 0x68], ecx
mov dword [esi + 0x38], eax
test eax, eax
jne 0x4c0372
cmp dword [esi + 4], eax
jne 0x4c031c
jmp 0x4c0372
or dword [esi + 0x38], 0xffffffff
pop edi
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x4c]
call fcn.004c37c1
mov dword [esi + 0x4c], eax
add esp, 0xc
mov eax, ebx
sub eax, dword [esi + 4]
pop ebx
jmp 0x4c0390
push 0xfffffffffffffffe
pop eax
pop esi
pop ebp
ret
Function at 0x4c0393
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
cmp esi, ebx
je 0x4c043d
cmp byte [esi + 0x5c], 0x77
jne 0x4c043d
mov dword [esi + 4], ebx
mov edi, 0x4000
sub edi, dword [esi + 0x10]
je 0x4c03e0
push dword [esi + 0x40]
push edi
push 1
push dword [esi + 0x48]
call fcn.004c5a9a
add esp, 0x10
cmp eax, edi
jne 0x4c0435
mov eax, dword [esi + 0x48]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x4000
test ebx, ebx
jne 0x4c0427
push dword [ebp + 8]
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push esi
call fcn.004c0a8f
pop ecx
pop ecx
mov ecx, dword [esi + 0x10]
sub dword [esi + 0x68], ecx
mov dword [esi + 0x38], eax
test edi, edi
jne 0x4c040a
cmp eax, 0xfffffffb
jne 0x4c040a
and dword [esi + 0x38], edi
test ecx, ecx
jne 0x4c0418
cmp dword [esi + 0x38], 1
je 0x4c0418
xor ebx, ebx
jmp 0x4c041b
xor ebx, ebx
inc ebx
mov eax, dword [esi + 0x38]
test eax, eax
je 0x4c03b4
cmp eax, 1
je 0x4c03b4
mov esi, dword [esi + 0x38]
mov eax, esi
dec eax
neg eax
sbb eax, eax
and eax, esi
jmp 0x4c0440
or eax, 0xffffffff
mov dword [esi + 0x38], eax
jmp 0x4c0440
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4c1507
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
mov dword [ebp - 8], edi
cmp eax, ecx
jb 0x4c1596
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.004ad4d0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4c1556
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4c1578
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x4c1654
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
cmp ecx, edx
jbe 0x4c15be
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x4c15c9
xor eax, eax
jmp 0x4c1615
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x4c15e6
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.004c37f4
jmp 0x4c15f6
cmp ecx, 2
jne 0x4c15ff
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.004c37c1
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.004ad4d0
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x4c1640
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x4c1654
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x4c1514
pop edi
pop ebx
leave
ret
Function at 0x404a80
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404c38
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404ae1
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404c54
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404b4e
xor eax, eax
push ebp
push 0x404b47
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404b30
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404c74
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404b4e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404c2f
cmp byte [ebp - 0xd], 0
jne 0x404b90
cmp byte [ebp - 0x12], 0
je 0x404c2f
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404ba9
dec ebx
cmp byte [ebx], 0x2e
je 0x404bb8
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404ba8
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404c2f
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404be5
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404c2f
cmp byte [ebp - 0xd], 0
je 0x404c2f
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404c2f
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408000
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408039
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403870
jmp 0x408042
mov eax, ebx
mov edx, esi
call fcn.00403824
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40804c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40806d
mov al, byte [esp]
jmp 0x40806f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x412f14
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x412f1a
ret

Function at 0x415338
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x415389
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x415370
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x415360
jmp 0x415389
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x415371
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c554
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x43d758], 0
sete dl
or al, dl
jne 0x41c698
mov eax, dword [0x43d75c]
mov bx, 0xffff
call fcn.00402de0
mov eax, dword [0x43d758]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x41c667
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x43d758]
call fcn.0040c954
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
je 0x41c65f
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x16c], 0
je 0x41c65f
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x41c65f
mov eax, dword [ebp - 0x10]
call fcn.00424390
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x41c65f
push ebp
call fcn.0041c510
pop ecx
test al, al
jne 0x41c65f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x8c]
cmp eax, dword [ebp - 0x10]
jne 0x41c61b
mov eax, dword [ebp - 0x10]
call fcn.00422cd8
dec eax
jle 0x41c65f
mov byte [ebp - 0x15], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x15]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov bx, 0xffc2
call fcn.00402de0
cmp byte [ebp - 0x15], 0
je 0x41c65f
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x41c65f
mov edx, dword [ebp - 0x10]
mov eax, dword [0x43d75c]
call fcn.0041bdc0
inc edi
dec esi
jne 0x41c5ae
mov eax, dword [0x43d75c]
cmp dword [eax + 8], 0
jle 0x41c67f
mov eax, dword [0x43d75c]
call fcn.0041be50
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41c698
push ebp
mov eax, dword [ebp - 0x14]
call fcn.0041c3c8
pop ecx
test al, al
jne 0x41c698
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret