joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404020
Capabilities:
Set global application hook

Disassembly:
push edi
xor eax, eax
sub esp, 0xb8
mov ecx, 0x25
lea edx, [esp + 0x1c]
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, dword [0x463030]
mov dword [esp + 0x1c], 0x94
test ecx, ecx
je 0x404050
add esp, 0xb8
pop edi
ret
mov dword [esp], edx
call sub.KERNEL32.dll_GetVersionExA
test eax, eax
push edx
je 0x404070
cmp dword [esp + 0x2c], 2
jne 0x404070
mov dword [0x463034], 1
nop
mov dword [0x46302c], 1
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [esp + 8], 0
mov dword [0x463038], eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x4037b0
mov dword [esp], 3
call sub.USER32.dll_SetWindowsHookExA
sub esp, 0x10
mov dword [0x46303c], eax
mov dword [esp], 1
call sub.WINMM.DLL_timeBeginPeriod
push edi
mov dword [esp], 0x403af0
call fcn.00401335
mov dword [0x463030], 1
add esp, 0xb8
pop edi
ret

Function at 0x4040e0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push ebx
sub esp, 0x44
lea esi, [esp + 0x24]
lea esi, [esi]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.USER32.dll_PeekMessageA
sub esp, 0x14
test eax, eax
je 0x404280
mov eax, dword [esp + 0x28]
cmp eax, 0x100
jb 0x4041d1
cmp eax, 0x101
jbe 0x404147
sub eax, 0x104
cmp eax, 1
ja 0x4041d1
mov eax, dword [esp + 0x2c]
cmp eax, 0x10
jb 0x4041d1
cmp eax, 0x12
jbe 0x404161
sub eax, 0x5b
cmp eax, 1
ja 0x4041d1
mov dword [0x463024], 0
mov dword [esp], 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
push ebx
js 0x404286
mov dword [esp], 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
push ecx
js 0x4042a0
mov dword [esp], 0x12
call sub.USER32.dll_GetKeyState
test ax, ax
push edx
js 0x404292
mov dword [esp], 0x5b
call sub.USER32.dll_GetKeyState
test ax, ax
push ebx
js 0x404210
mov dword [esp], 0x5c
call sub.USER32.dll_GetKeyState
test ax, ax
push ecx
js 0x404210
mov eax, dword [esp + 0x24]
mov dword [esp + 4], 0xfffffff0
mov dword [esp], eax
call sub.USER32.dll_GetWindowLongA
and eax, 0x40010000
push edx
cmp eax, 0x40010000
push edx
je 0x404220
mov dword [esp], esi
call sub.USER32.dll_TranslateMessage
push ebx
mov dword [esp], esi
call sub.USER32.dll_DispatchMessageA
push eax
jmp 0x4040f0
or dword [0x463024], 8
jmp 0x4041d1
mov eax, dword [esp + 0x24]
mov dword [esp], eax
jmp 0x404233
mov dword [esp], ebx
call sub.USER32.dll_GetParent
test eax, eax
push ebx
mov ebx, eax
je 0x4041f3
mov dword [esp + 4], 0xfffffff0
mov dword [esp], eax
call sub.USER32.dll_GetWindowLongA
and eax, 0x40010000
push ecx
cmp eax, 0x40010000
push ecx
je 0x404230
test ebx, ebx
je 0x4041f3
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.USER32.dll_IsDialogMessageA
test eax, eax
push edx
push edx
jne 0x4040f0
jmp 0x4041f3
add esp, 0x44
pop ebx
pop esi
ret
or dword [0x463024], 1
jmp 0x404181
or dword [0x463024], 4
jmp 0x4041ad
or dword [0x463024], 2
jmp 0x404197
Function at 0x4042b0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x10], 0xff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.USER32.dll_MsgWaitForMultipleObjects
sub esp, 0x14
add esp, 0x2c
jmp fcn.004040e0

Function at 0x404820
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x2c
mov edx, dword [0x463034]
mov eax, dword [esp + 0x30]
test edx, edx
mov dword [esp], eax
jne 0x404880
call fcn.004076a0
mov dword [esp + 0x14], 0xa
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
cmp eax, 0x20
setg al
and eax, 0xff
add esp, 0x2c
ret
call fcn.004076c0
mov dword [esp + 0x14], 0xa
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteW
sub esp, 0x18
cmp eax, 0x20
setg al
and eax, 0xff
add esp, 0x2c
ret

Function at 0x404b90
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x1c
mov edx, dword [0x46d3b0]
mov eax, dword [esp + 0x20]
test edx, edx
mov dword [esp], eax
jne 0x404bc0
call fcn.004076a0
mov dword [esp], eax
call sub.msvcrt.dll_getenv
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp fcn.00407100
call fcn.004076c0
mov dword [esp], eax
call sub.msvcrt.dll__wgetenv
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp fcn.00407070

Function at 0x404d80
Capabilities:
Create directory

Disassembly:
sub esp, 0x1c
mov ecx, dword [0x46d3b0]
mov eax, dword [esp + 0x20]
test ecx, ecx
mov dword [esp], eax
jne 0x404da5
call fcn.004076a0
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp 0x412500
call fcn.004076c0
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp 0x412508
jmp dword [sym.imp.msvcrt.dll__mkdir]
jmp dword [sym.imp.msvcrt.dll__wmkdir]

Function at 0x404dc0
Capabilities:
Delete directory

Disassembly:
sub esp, 0x1c
mov edx, dword [0x46d3b0]
mov eax, dword [esp + 0x20]
test edx, edx
mov dword [esp], eax
jne 0x404de5
call fcn.004076a0
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp 0x412510
call fcn.004076c0
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp 0x412518
jmp dword [sym.imp.msvcrt.dll__rmdir]
jmp dword [sym.imp.msvcrt.dll__wrmdir]

Function at 0x404e00
Capabilities:
Move file

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ecx, dword [0x46d3b0]
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
test ecx, ecx
mov dword [esp], eax
jne 0x404e40
call fcn.004076a0
mov dword [esp], ebx
mov esi, eax
call fcn.004076a0
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], eax
add esp, 0x14
pop ebx
pop esi
jmp 0x412520
call fcn.004076c0
mov dword [esp], ebx
mov esi, eax
call fcn.004076c0
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], eax
add esp, 0x14
pop ebx
pop esi
jmp 0x412528
jmp dword [sym.imp.msvcrt.dll_rename]
jmp dword [sym.imp.msvcrt.dll__wrename]
Function at 0x404e70
Capabilities:
Delete file

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov dword [esp + 4], 0x1b6
mov dword [esp], ebx
call fcn.00404d30
mov eax, dword [0x46d3b0]
mov dword [esp], ebx
test eax, eax
jne 0x404ea6
call fcn.004076a0
mov dword [esp + 0x20], eax
add esp, 0x18
pop ebx
jmp 0x412530
call fcn.004076c0
mov dword [esp + 0x20], eax
add esp, 0x18
pop ebx
jmp 0x412538
jmp dword [sym.imp.msvcrt.dll_remove]
jmp dword [sym.imp.msvcrt.dll__wremove]
Function at 0x404ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x1c
mov edx, dword [0x46d3b0]
mov eax, dword [esp + 0x20]
test edx, edx
mov dword [esp], eax
jne 0x404ee5
call fcn.004076a0
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp fcn.004114e0
call fcn.004076c0
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp 0x4118a4
push edi
push esi
push ebx
sub esp, 0x330
mov ebx, dword [esp + 0x340]
call sub.msvcrt.dll__errno
test ebx, ebx
mov dword [eax], 0
jne 0x4118d3
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
jmp 0x411a96
cmp word [ebx], 0
je 0x41195d
mov eax, dword [sym.imp.msvcrt.dll__osver]
mov eax, dword [eax]
test ah, 0x80
je 0x411939
lea esi, [esp + 0x22c]
mov dword [esp + 0x10], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x104
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_WideCharToMultiByte
sub esp, 0x20
mov dword [esp], esi
call sub.KERNEL32.dll_GetFileAttributesA
jmp 0x411941
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
push edx
jne 0x411959
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor ebx, ebx
jmp 0x411a96
test al, 0x10
jne 0x41196a
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
jmp 0x411952
lea edi, [esp + 0x24]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], edi
call sub.msvcrt.dll__wfullpath
mov dword [esp], edi
call sub.msvcrt.dll_wcslen
mov dword [esp], 0x45aac0
mov esi, eax
call sub.msvcrt.dll_wcslen
mov dword [esp], 0x45aac4
mov ebx, eax
call sub.msvcrt.dll_wcslen
lea edx, [esi + ebx + 0x21d]
add eax, edx
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
jne 0x4119cf
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
jmp 0x411a96
lea esi, [eax + 0x434]
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.msvcrt.dll_wcscpy
cmp word [ebx + 0x434], 0
je 0x411a45
mov dword [esp + 4], 0x2f
mov dword [esp], esi
call sub.msvcrt.dll_wcsrchr
mov dword [esp], esi
mov edi, eax
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax*2 + 0x432]
cmp edi, eax
je 0x411a45
mov dword [esp + 4], 0x5c
mov dword [esp], esi
call sub.msvcrt.dll_wcsrchr
mov dword [esp], esi
mov edi, eax
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax*2 + 0x432]
cmp edi, eax
je 0x411a45
mov dword [esp + 4], 0x45aac0
mov dword [esp], esi
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x45aac4
mov dword [esp], esi
call sub.msvcrt.dll_wcscat
lea edx, [ebx + 0x224]
mov ecx, 0x41
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebx + 0x42c], 0xffffffff
mov dword [ebx + 0x430], 0
mov dword [ebx + 0x21c], 0
mov word [ebx + 0x220], 0
mov word [ebx + 0x222], 0
add esp, 0x330
mov eax, ebx
pop ebx
pop esi
pop edi
ret
Function at 0x405b30
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x10]
mov dword [esp], 0x101
mov dword [esp + 4], eax
call sub.WSOCK32.DLL_WSAStartup
push ecx
push ecx
mov dword [esp], 0x404ab0
call fcn.00401335
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [0x46d3a0], eax
lea edx, [eax + 0x20]
add eax, 0x40
mov dword [0x46d3a8], edx
mov dword [0x46d3a4], eax
add esp, 0x1ac
ret

Function at 0x409fa0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
mov eax, dword [0x46d1e0]
test eax, eax
je 0x409fb5
mov eax, dword [0x46d1e4]
add esp, 0xc
ret
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x46d1e0], 1
mov dword [0x46d1e4], eax
add esp, 0xc
ret

Function at 0x409fd0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.00409fa0
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
push edx
add esp, 0x1c
ret

Function at 0x409ff0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.00409fa0
mov edx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.KERNEL32.dll_TlsSetValue
push ecx
push ecx
add esp, 0x1c
ret
Function at 0x40a820
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov dword [esp], 0x46d3b4
call sub.KERNEL32.dll_InitializeCriticalSection
push eax
call sub.KERNEL32.dll_TlsAlloc
mov dword [esp], 0xb8
mov dword [0x46d304], eax
call sub.msvcrt.dll_malloc
mov ecx, 0x20
mov ebx, eax
lea edx, [eax + 8]
mov dword [eax + 4], 0
mov edi, edx
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [0x46d3ac]
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], eax
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [ebx + 0xb4], eax
call sub.KERNEL32.dll_GetCurrentProcess
mov edi, eax
call sub.KERNEL32.dll_GetCurrentThread
mov esi, eax
call sub.KERNEL32.dll_GetCurrentProcess
lea edx, [ebx + 0xb0]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
test eax, eax
je 0x40a8f9
mov eax, dword [0x46d304]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
mov dword [0x46d30c], ebx
push eax
push eax
mov eax, dword [0x46d308]
mov dword [0x46d308], ebx
mov dword [ebx], eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp], 0xffffffff
call sub.msvcrt.dll_exit
lea esi, [esi]
lea edi, [edi]
push edi
push esi
push ebx
xor esi, esi
sub esp, 0x2f0
mov dword [esp], 0xb8
call sub.msvcrt.dll_malloc
mov ebx, eax
mov eax, dword [esp + 0x300]
mov ecx, 0x20
lea edx, [ebx + 8]
mov dword [ebx + 4], eax
mov edi, edx
mov eax, esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x304]
mov dword [ebx + 0x88], 0
mov dword [ebx + 8], eax
lea eax, [ebx + 0xb4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40a740
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
mov ecx, 0xb3
sub esp, 0x18
mov edx, eax
mov dword [ebx + 0xb0], eax
mov eax, esi
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x10001
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetThreadContext
push eax
push eax
mov eax, dword [esp + 0xe8]
mov dword [ebx + 0x8c], eax
mov eax, dword [0x46d3cc]
test eax, eax
jne 0x40aa43
mov edi, 0x46d310
mov esi, dword [edi]
test esi, esi
je 0x40a9ec
mov eax, dword [esi + 0x88]
test eax, eax
jne 0x40aa26
mov edi, esi
mov esi, dword [edi]
test esi, esi
jne 0x40a9da
mov eax, dword [0x46d308]
mov edx, dword [0x46d3cc]
mov dword [ebx], eax
mov dword [0x46d308], ebx
test edx, edx
je 0x40aa10
mov dword [esp], 0x46d3b4
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
mov dword [0x46d3cc], 1
add esp, 0x2f0
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 0xb0]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push ecx
mov dword [esp], esi
call fcn.004123f8
jmp 0x40a9d4
mov dword [esp], 0x46d3b4
call sub.KERNEL32.dll_EnterCriticalSection
push eax
jmp 0x40a9cf
Function at 0x411f73
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
jne 0x411fb7
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00411f38
mov eax, dword [esp + 0x24]
cmp eax, 4
je 0x411fec
cmp eax, 0x40
je 0x411fec
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edi, ebx
mov ecx, ebp
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x24]
cmp eax, 4
je 0x412027
cmp eax, 0x40
je 0x412027
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x412208
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x46d380
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x46d398]
push ecx
jmp 0x412247
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
push edx
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x412244
test esi, esi
je 0x412244
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x412222
mov dword [esp], 0x46d380
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x419ff9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push dword [ebx + 0x80]
call sub.USER32.dll_GetWindowTextLengthW
add eax, 1
push eax
push 0x447b1a
call fcn.00409820
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push dword [eax + 0x14]
mov eax, dword [ebp - 4]
lea eax, [eax + 0x18]
push eax
push dword [ebx + 0x80]
call sub.USER32.dll_GetWindowTextW
mov eax, dword [ebp - 4]
lea eax, [eax + 0x18]
push eax
call fcn.00407070
add esp, 4
jmp 0x41a04d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a0e8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp eax, 0
je 0x41a108
push 5
push dword [ebx + 0x80]
call sub.USER32.dll_ShowWindow
jmp 0x41a147
mov eax, dword [ebx + 0xc]
cmp eax, 0x43bf80
setne al
movzx eax, al
cmp eax, 0
je 0x41a12a
call fcn.00429087
push eax
push ebx
mov eax, dword [ebx]
call dword [eax + 0x34]
add esp, 8
cmp eax, 0
je 0x41a13a
push dword [ebx + 0xc]
call fcn.00429068
add esp, 4
push 0
push dword [ebx + 0x80]
call sub.USER32.dll_ShowWindow
mov eax, 0
jmp 0x41a14e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426038
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, 0
push 0x10
call sub.USER32.dll_GetKeyState
and eax, 0x8000
cmp eax, 0
je 0x426057
or ebx, 1
push 0x11
call sub.USER32.dll_GetKeyState
and eax, 0x8000
cmp eax, 0
je 0x42606b
or ebx, 2
push 0x12
call sub.USER32.dll_GetKeyState
and eax, 0x8000
cmp eax, 0
je 0x42607f
or ebx, 4
push 0x5b
call sub.USER32.dll_GetKeyState
and eax, 0x8000
cmp eax, 0
jne 0x42609c
push 0x5c
call sub.USER32.dll_GetKeyState
and eax, 0x8000
cmp eax, 0
je 0x4260a4
or ebx, 8
mov eax, ebx
jmp 0x4260a8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4101ac
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestRollingMean.exe_gMozillaPoisonSize], eax
call fcn.0040c5d3
pop ecx
mov ecx, dword [sym.TestRollingMean.exe_gMozillaPoisonSize]
mov dword [sym.TestRollingMean.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x4101e4
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestRollingMean.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402678
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403150
test esi, esi
jne 0x4026ae
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403214
jmp 0x4026cc
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040258c
mov edi, eax
test esi, esi
je 0x4026cc
cmp dword [ebx], 0
je 0x4026cc
dec esi
jmp 0x4026b5
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4028f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40700c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40298c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40296c
xor eax, eax
push ebp
push 0x402965
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4029a8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40296c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40700c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40700c], ax
mov esp, ebp
pop ebp
ret

Function at 0x402fd4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x409034], 0
je 0x403035
cmp word [0x409208], 0xd7b2
jne 0x402ffd
cmp dword [0x409210], 0
jbe 0x402ffd
mov eax, 0x409204
call dword [0x409220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40704c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40305c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x407018], 0
jne 0x403051
push 0
push 0x40706c
push 0x40704c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4044c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40458f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x108]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00403284
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 4]
mov ecx, 0x4045a4
call fcn.004032e8
mov edx, dword [0x409720]
mov eax, 0x4045a4
call fcn.0040357c
test eax, eax
jne 0x404547
mov edx, dword [0x409720]
mov eax, 0x4045b0
call fcn.0040357c
test eax, eax
je 0x404556
mov eax, ebx
mov edx, dword [0x409720]
call fcn.004031a4
jmp 0x40456e
lea eax, [ebp - 4]
mov edx, dword [0x409720]
call fcn.004032a4
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004031a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404596
lea eax, [ebp - 0x10c]
call fcn.00403150
lea eax, [ebp - 4]
call fcn.00403150
ret
Function at 0x4045b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x104], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x404757
push dword fs:[edx]
mov dword fs:[edx], esp
cmp eax, 6
ja case.default.0x4045eb
jmp dword [eax*4 + 0x4045f2]
lea eax, [ebp - 0x100]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00403284
jmp case.default.0x4045eb
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
jne 0x404652
mov byte [ebp - 0x100], 0x43
mov al, byte [ebp - 0x100]
push eax
call sub.user32.dll_IsCharAlphaA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x40466f
mov byte [ebp - 0x100], 0x43
lea eax, [ebp - 0x104]
mov dl, byte [ebp - 0x100]
call fcn.00403244
mov edx, dword [ebp - 0x104]
mov eax, ebx
mov ecx, 0x40476c
call fcn.004032e8
jmp case.default.0x4045eb
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
jne 0x4046b3
mov byte [ebp - 0x100], 0x43
mov al, byte [ebp - 0x100]
push eax
call sub.user32.dll_IsCharAlphaA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4046d0
mov byte [ebp - 0x100], 0x43
lea eax, [ebp - 0x108]
mov dl, byte [ebp - 0x100]
call fcn.00403244
mov edx, dword [ebp - 0x108]
mov eax, ebx
mov ecx, 0x404788
call fcn.004032e8
jmp case.default.0x4045eb
lea edx, [ebp - 0x10c]
xor eax, eax
call fcn.00402678
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00404360
jmp case.default.0x4045eb
mov eax, ebx
mov edx, 0x4047ac
call fcn.004031a4
jmp case.default.0x4045eb
mov eax, ebx
mov edx, 0x4047b8
call fcn.004031a4
jmp case.default.0x4045eb
mov eax, ebx
mov edx, 0x4047c4
call fcn.004031a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40475e
lea eax, [ebp - 0x10c]
mov edx, 3
call fcn.00403174
ret

Function at 0x4047c8
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x404856
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x404831
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 8]
call fcn.00403254
mov ecx, dword [ebp - 8]
mov edx, dword [0x408138]
mov edx, dword [edx]
lea eax, [ebp - 4]
call fcn.004032e8
mov eax, dword [ebp - 4]
call fcn.00403494
push eax
call sub.kernel32.dll_WinExec
push 0
call sub.kernel32.dll_ExitProcess_1