joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484360
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e60
call fcn.004a04a0
mov eax, dword [esp + 0x8e68]
push ebx
push ebp
mov ebp, dword [esp + 0x8e6c]
push esi
mov esi, ecx
mov cl, byte [edx]
xor ebx, ebx
cmp cl, 0x41
je 0x48438b
cmp cl, 0x61
jne 0x4843e9
cmp byte [edx + 1], bl
jne 0x4843e9
cmp byte [edi], bl
jne 0x4843e9
cmp byte [eax], bl
jne 0x4843e9
cmp byte [esi], bl
jne 0x4843e9
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x4843ca
cmp byte [ebp + 0xca], bl
jne 0x4843ca
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4843c8
push esi
call fcn.00484f40
add esp, 4
test al, al
je 0x4843ca
xor esi, esi
cmp byte [esp + 0x8e7c], bl
je 0x4843dd
cmp esi, ebx
je 0x4843dd
mov dword [ebp + 0xa4], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
cmp cl, bl
jne 0x48440a
cmp byte [edi], bl
jne 0x48440a
cmp byte [eax], bl
jne 0x48440a
cmp byte [esi], bl
jne 0x48440a
mov eax, ebp
call fcn.00484550
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x828], 0x4a78b1
mov byte [esp + 0xc45], bl
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc50], ebx
mov dword [esp + 0xc54], ebx
mov dword [esp + 0xc58], ebx
mov dword [esp + 0xc5c], ebx
mov dword [esp + 0xc68], ebx
mov dword [esp + 0xc6c], ebx
call fcn.004850a0
test eax, eax
je 0x48450b
test byte [esp + 0xc], 2
mov al, byte [esp + 0x8e78]
mov byte [esp + 0xc35], al
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
je 0x484517
mov eax, dword [esp + 0x828]
cmp eax, 0xffff
je 0x4844e3
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x48450b
cmp byte [ebp + 0xca], bl
jne 0x4844dc
mov esi, dword [esp + 0x828]
call fcn.00484fb0
cmp al, bl
jne 0x4844dc
mov ecx, dword [esp + 0x828]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
je 0x48450b
mov eax, dword [esp + 0x828]
cmp dword [esp + 0xc5c], eax
je 0x4844fc
lea esi, [esp + 0xc]
mov dword [esp + 0xc5c], eax
call fcn.004854e0
push ebx
lea edx, [esp + 0x10]
push edx
call fcn.004855a0
test eax, eax
jne 0x484527
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
lea eax, [esp + 0xc]
push eax
push 0x4845d0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0xc3c]
cmp byte [esp + 0x8e7c], bl
je 0x484541
cmp eax, ebx
je 0x484541
mov dword [ebp + 0xa4], eax
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
Function at 0x484750
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x8018
call fcn.004a04a0
push ebx
push ebp
mov ebp, dword [esp + 0x8028]
push esi
push edi
mov edi, dword [esp + 0x802c]
mov esi, ecx
test edi, edi
je 0x484779
mov ecx, edi
call fcn.0041c270
cmp dword [esp + 0x8038], 0
jne 0x48478e
mov dword [esp + 0x8038], 0x1f4
cmp dword [esp + 0x803c], 1
jge 0x4847a3
mov dword [esp + 0x803c], 0x32
cmp ebp, 1
jge 0x4847ad
mov ebp, 1
test esi, esi
je 0x48497a
mov ebx, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
lea eax, [esp + 0x20]
push eax
push 0x7d0
push 2
push 0
push 0
push 0x406
push esi
call ebx
test eax, eax
je 0x48497a
cmp ebp, dword [esp + 0x20]
jg 0x48497a
push 0x8000
xor eax, eax
mov ecx, esi
lea edi, [esp + 0x1c]
call fcn.00481260
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
test edi, edi
je 0x484973
dec ebp
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x24], eax
jmp 0x484820
lea ecx, [esp + 0x14]
push ecx
push 0x7d0
push 2
push 0
push ebp
push 0x403
push esi
call ebx
test eax, eax
je 0x484897
mov edx, 0x7fff
cmp word [esp + 0x14], dx
ja 0x4848ee
lea eax, [esp + 0x14]
push eax
push 0x7d0
push 2
push edi
push ebp
push 0x402
push esi
call ebx
test eax, eax
je 0x484897
movzx ecx, word [esp + 0x14]
mov eax, dword [esp + 0x18]
push 0
inc ecx
push ecx
lea edx, [esp + 0x30]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4848e9
mov edx, dword [esp + 0x8034]
lea eax, [esp + 0x28]
call fcn.00483ca0
test al, al
jne 0x484914
cmp dword [esp + 0x802c], 0
jne 0x4848f8
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x484947
mov edi, dword [esp + 0x8038]
test edi, edi
js 0x4848ce
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x24]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x48492c
mov edx, dword [esp + 0x803c]
push 1
push edx
call fcn.004014b0
mov edi, dword [esp + 0x24]
add esp, 8
jmp 0x484820
mov byte [esp + 0x28], 0
cmp dword [esp + 0x802c], 0
je 0x484947
mov eax, dword [esp + 0x802c]
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x34]
push edx
push eax
call fcn.00482f60
mov esi, eax
jmp 0x48494c
mov eax, dword [0x4bbcb4]
push 1
push 0
push 0xffffffffffffffff
push 0x4a7940
push eax
call fcn.00482f60
jmp 0x4848ee
mov ecx, dword [0x4bbcb4]
push 1
push 0
push 0xffffffffffffffff
push 0x4a7de4
push ecx
call fcn.00482f60
mov edi, dword [esp + 0x1c]
mov esi, 1
push 0x8000
push 0
push edi
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov edi, dword [esp + 0x802c]
mov eax, 0x4a7de4
test edi, edi
jne 0x484988
mov eax, 0x4aa2f0
mov ecx, dword [0x4b7a70]
test byte [ecx + 0xe0], 1
jne 0x4849b5
mov edx, dword [0x4bbcb4]
push 1
push 0
push 0xffffffffffffffff
push eax
push edx
call fcn.00482f60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov ebx, dword [0x4bc83c]
push 0x4a78b1
push 0
push eax
call fcn.0043b0a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
Function at 0x4854e0
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0xc50]
test ecx, ecx
je 0x485597
mov eax, dword [esi]
test eax, eax
je 0x485597
push edi
test al, 1
jne 0x485509
mov eax, dword [esi + 0x80c]
cmp byte [eax], 0
je 0x485522
push 0x7fff
lea edi, [esi + 0xc58]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jne 0x485522
mov byte [edi], al
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x48553d
mov edx, dword [esi + 0xc50]
lea ecx, [esi + 0xc54]
push ecx
push edx
call edi
test byte [esi], 0x20
je 0x485578
mov ecx, dword [esi + 0xc50]
lea eax, [esp + 4]
push eax
push ecx
call edi
test eax, eax
je 0x485578
movzx edx, byte [esi + 0xc28]
mov ecx, dword [esp + 4]
push edx
lea eax, [esi + 0x8d58]
call fcn.0045b9b0
add esp, 4
test eax, eax
jne 0x485578
mov byte [esi + 0x8d58], al
test byte [esi], 8
pop edi
je 0x485597
mov ecx, dword [esi + 0xc50]
push 0x101
lea eax, [esi + 0x8c57]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
pop ecx
ret

Function at 0x485ce0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e5c
call fcn.004a04a0
mov eax, dword [esp + 0x8e60]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x485d8d
mov dword [esp + 0xc44], eax
lea eax, [esp + 4]
push eax
push 0x486500
mov dword [esp + 0xc], ebx
mov dword [esp + 0x818], 0x4a78b1
mov byte [esp + 0xc35], bl
mov dword [esp + 0xc38], ebx
mov dword [esp + 0xc3c], ebx
mov dword [esp + 0xc40], ebx
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc58], ebx
mov dword [esp + 0xc5c], ebx
mov byte [esp + 0xc50], cl
mov dword [esp + 0xc54], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0xc34], ebx
je 0x485d8d
mov ecx, dword [0x4b7a70]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x485d8d
push 1
push eax
call fcn.004014b0
add esp, 8
mov eax, 1
pop ebx
add esp, 0x8e5c
ret 4
Function at 0x485da0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x485dbc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4b7a70]
push eax
push esi
mov ecx, edi
call fcn.00486300
cmp byte [edi], 0
je 0x485def
test eax, eax
jne 0x485df7
mov edx, dword [esp + 0x1c]
push eax
push edx
push edi
call fcn.00485ed0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x485e98
test esi, esi
je 0x485e72
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.004014b0
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x485e55
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x485e55
push 1
push 0x8000012f
call fcn.004014b0
add esp, 8
push esi
call edi
test eax, eax
jne 0x485e30
mov edx, dword [0x4b7a70]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x485e6e
push 1
push eax
call fcn.004014b0
add esp, 8
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x485eb2
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
je 0x485e98
mov ecx, dword [0x4b7a70]
push ecx
push eax
mov ecx, edi
call fcn.00486300
test eax, eax
jne 0x485daf
cmp byte [edi], 0
je 0x485eb2
mov edx, dword [esp + 0x1c]
push 0
push edx
push edi
call fcn.00485ed0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x1c]
push eax
mov ecx, edi
call fcn.004860d0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x485ed0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e68
call fcn.004a04a0
mov eax, dword [esp + 0x8e74]
push ebx
push ebp
mov ebp, dword [esp + 0x8e74]
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x485ef4
mov dword [eax], edi
cmp dword [ebp + 8], edi
je 0x486094
mov cl, 1
mov eax, ebp
call fcn.00486270
test eax, eax
je 0x4860ba
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4b7a70]
push eax
push esi
mov ecx, ebp
call fcn.00486300
test eax, eax
setne cl
mov byte [esp + 0x17], cl
test cl, cl
jne 0x485f3a
xor eax, eax
mov dword [0x4bc434], eax
jmp 0x485f3f
mov eax, dword [0x4bc434]
cmp byte [esp + 0x8e80], 0
mov dword [esp + 0xc44], edi
mov dword [esp + 0xc48], edi
mov dword [esp + 0xc4c], edi
mov dword [esp + 0xc58], edi
mov dword [esp + 0xc64], edi
mov dword [esp + 0xc68], edi
je 0x485f7f
mov byte [esp + 0xc41], 0
test cl, cl
je 0x485f87
mov byte [esp + 0xc41], 1
mov edx, dword [0x4bc430]
mov ecx, 0x4a78b1
mov dword [esp + 0x824], ecx
mov dword [esp + 0x82c], ecx
mov dword [esp + 0x830], ecx
mov ecx, dword [0x4b7a70]
cmp eax, edi
mov dword [esp + 0x828], edi
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0xc50], edx
mov dword [esp + 0xc54], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x83c], ebp
mov dword [esp + 0x18], 0x10
setg bl
cmp byte [esp + 0x17], 0
je 0x48600a
xor ecx, ecx
test eax, eax
jle 0x485ffa
lea ecx, [ecx]
cmp dword [edx + ecx*4], esi
je 0x48600a
inc ecx
cmp ecx, eax
jl 0x485ff0
cmp eax, 0x1f4
jge 0x48600a
mov dword [edx + eax*4], esi
inc eax
mov dword [0x4bc434], eax
lea edx, [esp + 0x18]
push edx
push 0x4845d0
mov dword [esp + 0xc5c], eax
call edi
mov eax, dword [esp + 0xc48]
test eax, eax
jne 0x48603b
test bl, bl
je 0x4860a6
mov edx, dword [0x4bc430]
mov dword [0x4bc434], eax
xor bl, bl
jmp 0x485fe0
call fcn.00483e40
mov ecx, dword [0x4bc434]
mov edx, dword [esp + 0xc48]
mov esi, dword [0x4bc430]
xor eax, eax
test ecx, ecx
jle 0x48606a
lea esp, [esp]
cmp dword [esi + eax*4], edx
je 0x48607c
inc eax
cmp eax, ecx
jl 0x486060
cmp ecx, 0x1f4
jge 0x48607c
mov dword [esi + ecx*4], edx
inc ecx
mov dword [0x4bc434], ecx
mov eax, dword [0x4b7a70]
mov eax, dword [eax + 0x54]
cmp eax, 0xffffffff
jle 0x486094
push 1
push eax
call fcn.004014b0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 0xc
mov ecx, dword [esp + 0x8e84]
test ecx, ecx
je 0x4860ba
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4860ba
mov dword [ecx], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x8e68
ret 0xc
Function at 0x4860d0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e68
call fcn.004a04a0
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x486250
xor cl, cl
mov eax, edi
call fcn.00486270
test eax, eax
jne 0x486105
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4b7a70]
push eax
push ebp
mov ecx, edi
call fcn.00486300
test eax, eax
je 0x486128
xor eax, eax
mov dword [0x4bc434], eax
jmp 0x48612d
mov eax, dword [0x4bc434]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x824], 0x4a78b1
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc64], ebx
mov dword [esp + 0xc68], ebx
cmp byte [esp + 0x8e7c], bl
je 0x486173
mov byte [esp + 0xc41], bl
cmp eax, ebx
je 0x48617b
mov byte [esp + 0xc41], 1
mov ecx, dword [0x4bc430]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0xc54], eax
lea eax, [esp + 0x18]
push eax
push 0x4863d0
mov dword [esp + 0xc58], ecx
mov dword [esp + 0xc60], edx
call esi
mov eax, dword [esp + 0xc48]
cmp eax, ebx
je 0x486228
lea ecx, [esp + 0x10]
push ecx
push 0x484e10
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x4861e5
mov edx, dword [esp + 0xc48]
call fcn.004859f0
mov dword [esp + 0xc48], esi
mov eax, dword [esp + 0xc48]
call fcn.00483e40
mov edx, dword [esp + 0xc48]
call fcn.004859f0
mov edx, dword [0x4b7a70]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x486250
push 1
push eax
call fcn.004014b0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
mov eax, dword [0x4bc434]
cmp eax, ebx
je 0x486250
cmp eax, 1
setg al
mov dword [0x4bc434], ebx
cmp al, bl
je 0x486250
mov edx, ebp
call fcn.004859f0
push ebx
mov ecx, edi
call fcn.004860d0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x8e68
ret 4
Function at 0x499f20
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b6b1c]
jne 0x499f2a
repz ret
jmp fcn.0049f645

Function at 0x49cd70
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b6b1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00497482
and dword [ebp - 0x14], 0
cmp dword [0x4b9ccc], 0
mov dword [ebp - 0x18], eax
jne 0x49ce23
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x49cecb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x49cecb
mov esi, dword [fcn.00492f00]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4b9ccc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4b9cd0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4b9cd4], eax
call edi
push eax
call esi
mov dword [0x4b9cdc], eax
test eax, eax
je 0x49ce23
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4b9cd8], eax
mov eax, dword [0x4b9cd8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00492f04]
cmp eax, ecx
je 0x49ce7c
cmp dword [0x4b9cdc], ecx
je 0x49ce7c
push eax
call esi
push dword [0x4b9cdc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x49ce7c
test ebx, ebx
je 0x49ce7c
call edi
test eax, eax
je 0x49ce73
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x49ce73
test byte [ebp - 8], 1
jne 0x49ce7c
or dword [ebp + 0x10], 0x200000
jmp 0x49ceaf
mov eax, dword [0x4b9cd0]
cmp eax, dword [ebp - 0x18]
je 0x49ceaf
push eax
call esi
test eax, eax
je 0x49ceaf
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x49ceaf
mov eax, dword [0x4b9cd4]
cmp eax, dword [ebp - 0x18]
je 0x49ceaf
push eax
call esi
test eax, eax
je 0x49ceaf
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4b9ccc]
call esi
test eax, eax
je 0x49cecb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x49cecd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00499f20
leave
ret
Function at 0x402403
Capabilities:
Enumerate files on windows
Get disk size
Get geographical location
Print debug messages
Query environment variable

Disassembly:
inc eax
add dl, bh
jbe 0x402397
add dl, ah
mov dword [0xa22759], eax
push 0x40c0cd
jmp [ebp - 0x1dbfc917]
daa
mov byte [0xc0cd6800], al
inc eax
add bh, bh
lodsd eax, dword [esi]
jmp 0xe92263e0
inc eax
loop 0x402392
popal
add dl, ah
add byte [ebx + 0x40bb6d], ah
push 0x402249
jecxz 0x4023ef
jmp 0xe840c5f5
and ah, byte [edx - 0x3417b000]
add byte [eax], al
add byte [edi], bh
popal
daa
inc eax
loop 0x402456
push 0x40bf32
push eax
cli
push es
add byte [eax], al
loop 0x4023ad
daa
mov byte [0x5955c300], al
in eax, 0x83
in al, dx
salc
mov edi, dword [ebp + 8]
jl 0x40239b
aas
dec ebp
mov byte [ebp + 0x65], dh
mov eax, ebp
add edx, dword [edi + 0x3c]
jl 0x4023a7
cmp dl, byte [eax - 0x63]
jne 0x402484
mov dword [ebp + 0x6a428bf4], ecx
add eax, dword [ebp + 8]
pop ecx
inc ebp
clc
mov esp, dword [edx - 0x25bafce0]
mov dword [ebp - 4], eax
mov cl, 0xc9
mov edx, dword [ebp - 0x16]
cmp ecx, dword [edx + 0x18]
cmp cl, byte gs:[ebx + 0x1c8be65d]
mov ebx, edi
pop ebp
or bh, bh
insd dword es:[edi], dx
or al, 0x53
push ebx
call fcn.0040220a
pop edi
clc
add dword [edi + ebx*8 + 0x41], esi
jmp 0x402442
mov cl, 0xc0
mov esp, ebp
test edx, eax
or byte [eax], al

Function at 0x4042a0
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x402740]
call dword [sym.imp.pdh.dll_PdhValidatePathA]
and eax, 0xf
add eax, 0xb
xor edi, edi
xor esi, esi
cmp eax, 0x18
je 0x4042c9
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x403705], eax
ret
Function at 0x44ba10
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esi], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov cl, byte [0x7d204d]
mov dword [0x7d5a8c], eax
mov al, byte [0x7d204a]
mov edx, dword [0x7d2030]
and cl, al
mov eax, dword [0x7d2034]
mov byte [0x7d204d], cl
mov ecx, eax
shr ecx, 2
sub edx, ecx
xor ecx, ecx
mov cl, byte [0x7d2043]
mov dword [0x7d2030], edx
mov edx, dword [0x7d2038]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
or edx, 7
push 0x10
imul edx, ecx
and eax, edx
mov dword [0x7d2034], eax
call edi
test ax, ax
jge 0x44ba85
or dword [esi], 0x2000000
mov edx, dword [0x7d2030]
mov eax, dword [0x7d2034]
shr edx, 0xc
or edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov eax, dword [0x7d5a8c]
fild qword [esp + 8]
push eax
fadd qword [0x7d2050]
fstp qword [0x7d2050]
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
push 0x11
call edi
test ax, ax
jge 0x44bacc
or dword [esi], 0x4000000
push 0x12
call edi
test ax, ax
jge 0x44badb
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
add esp, 8
ret 4

Function at 0x51f33f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp - 0x1e0824d0], ecx
sahf
fild qword [ecx]
mov dh, 0xaf
hlt
sub dword [esi + 0x2920f4af], esi
cmpsd dword [esi], dword es:[edi]
retf
jmp 0x51f298
sub edi, esi
mov eax, dword [0x58297a96]
test dword gs:[edi], 0x6c7eb611
sbb edx, ecx
test dword [ebp + ebp - 0x2fec3e12], edi
adc byte [eax + 0x37], bl
aaa
jg 0x51f2a0
xchg esp, eax
sar byte [ecx], 0x9b
mov al, 0x43
mov ebx, 0xa999fce
test eax, 0x26e8fb16
je 0x51f37e
pop ebp
jbe 0x51f2f5
cmp al, 0xc3
dec esi
int1
imul edi, dword [edx - 0x708ef183], 0xffffffde
sub edx, esp
leave
jge 0x51f33c
jno 0x51f2bf
fisubr word [ebx]
aam 0xc9
push eax
and al, 0xff
das
invalid
in eax, dx
stosb byte es:[edi], al
mov cl, 0x73
jae 0x51f30e
push ss
jae 0x51f30e
push ss
or eax, 0x1e366028
les ecx, [ecx]
wait
push ecx
push 0x1d6b6afe
loope 0x51f32c
xor eax, 0xf4dcb6cf
add dword [esi - 0x38], esp
mov dword [0x73e7f373], eax
out 0xca, al
mov al, byte [0x24cf5229]
invalid
jmp edi

Function at 0x53b81b
Capabilities:
Encode data using xor

Disassembly:
shr dword [eax + 0x68], 1
sub bl, byte [edi + 0x46e67464]
test eax, 0xcfaa96e9
daa
cmp ah, byte [ecx + 0x48]
invalid
Function at 0x56dba0
Capabilities:
Encode data using xor

Disassembly:
pop ebx
repe scasb al, byte es:[edi]
test eax, 0x8d20bff1
and eax, edi
cmp byte [edx + ebp*2 + 0x1a], bh
jp 0x56dbbf
aad 0x6c
pushfd
sti
leave
jmp 0x56dba4
add ah, byte [esp + ebx]
inc ecx
outsd dx, dword [esi]
invalid
xor dword [esi], edx
inc ebx
mov ebp, 0x4b2db56a
push 0xd4efe50e
xchg edx, eax
imul ecx, dword [ebp + 0x4bb2fa4b], 0xffffffb2
lea ecx, [ebx - 6]
mov dl, 0x4b
mov dl, 0x51
lea ecx, [ebx - 6]
mov dl, 0x4b
dec ebx
mov dl, 0x51
dec esp
adc eax, 0xa2a35116
cli
inc esp
sar byte [0x4c0395ac], cl
jge 0x56db91
out 0x98, al
rcr byte [edi], 0x56
fdiv st(6)
jg 0x56db45
idiv byte [edi - 0x7d]
push ebp
and eax, 0x87f46d76
inc eax
sub byte ds:[edx], bh
cmp byte [ebx], bh
pop ebx
test byte [ecx], dl
push edx
jb 0x56db64
add dword ds:[ebx + esi*2 + 0x66], ecx
lahf
sub al, 0x87
add al, 0xe5
push ds
add edx, ebp
dec esi
aad 0xab
inc edi
adc edi, dword [esi + 6]
dec edx
or esp, dword [edi - 0x4d098b5a]
jge 0x56dbed
div byte [edx + 0x10c9fc7d]
sbb al, 0x7e
leave
adc byte [esi + edi*2], bl
sub al, bl
xchg ebx, eax
inc ax
std
or bl, byte [eax + edx*2 - 0x22]
salc
add dword [eax], edx
push ecx
outsb dx, byte [esi]
xchg dword [esi + 0x4f], edi
ja 0x56dbcf
add dword [eax], ebp
pop eax
mov edi, 0xbf518279
inc edi
aaa
test al, 0xd8
adc eax, 0x3132bfde
pop es
mov eax, 0x72695ab0
aas
mov ecx, 0xf7f83f2
pop esp
rcl dword [ebp - 0x72], 0xf5
daa
adc dh, dl
mov esi, 0x3d9aebb5
dec edi
sub byte [0xd5bdb794], bh
fnstsw ax
jmp 0x56dc7d
pop ebp
xor ch, byte [edx]
mov eax, dword [0x8ce12684]
xor eax, 0x2eb6512a
loopne 0x56dcc4
loope 0x56dd08
fidivr dword [eax]
and bl, byte [edx]
adc al, 0x85
nop
xlatb
push ebx
sal byte [ecx], 1
inc ecx
sub byte [ebp - 0x18814cd4], ah
sal dword [edx - 0x4027ace2], cl
cmp dh, byte [0xc8e845f6]
inc esi
mov esp, dword [ebp + 0x6d92bafa]
mov cl, 0xf7
imul byte [edx - 0x748f1b46]
xchg esi, eax
enter 0x54af, 0xffffffffffffff8b
lodsd eax, dword [esi]
and dword [esi + eax*4 + 3], ebx
xchg byte [ebx], al
test al, 0xfa
das
inc ebp
push 0x78
cmp bh, byte [eax]
outsb dx, byte [esi]
outsb dx, byte [esi]
inc edx
retf 0x2fe
pop ecx
out 0x7f, eax
adc byte [ecx - 0x30df9d60], ah
cmc
sub cl, byte [esi]
jnp 0x56dd4e
ret 0xf7ba
mov edi, 0xd15c4a79
pop ecx
or bh, al
and esp, dword [ebp - 0x72]
dec edi
inc cx
call 0xcf17d2e2
pop ebx
mov dword [ebp - 0x1c], ecx
xor edx, esi
clc
cmp eax, 0x8f4021a7
jbe 0x56dd62
push eax
add al, 0xcb
mov byte [0x534a9f06], al
mov word ds:[ecx + 0x2f1a06d2], ds
jne 0x56ddb3
dec esi
cmpsb byte [esi], byte es:[edi]
or esp, 0x4bb75d5e
add bh, bh
pop ds
add eax, 0x5dfd15e0
xchg byte [esi + 0x71c44e6e], ch
lodsd eax, dword [esi]
dec esi
les esi, [ecx - 0x53]
lea edi, [ebp - 0x71]
and eax, 0x2a48e761
inc eax
push eax
ja 0x56dce5
cmpsd dword cs:[esi], dword es:[edi]
cwde
or al, 0xec
in al, dx
cmpsb byte [esi], byte es:[edi]
insb byte es:[edi], dx
jmp 0xbb7be7ee
invalid