joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402760
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40276e
call dword [0x47e014]
or eax, eax
je 0x40276f
ret
mov al, 1
jmp fcn.00402838

Function at 0x402778
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402786
call dword [0x47e018]
or eax, eax
jne 0x402787
ret
mov al, 2
jmp fcn.00402838

Function at 0x402790
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4027c8
test edx, edx
je 0x4027b2
push eax
mov eax, ecx
call dword [0x47e01c]
pop ecx
or eax, eax
je 0x4027c1
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402838
mov dword [eax], edx
mov eax, ecx
call dword [0x47e018]
or eax, eax
jne 0x4027ab
ret
mov al, 1
jmp fcn.00402838
test edx, edx
je 0x4027dc
push eax
mov eax, edx
call dword [0x47e014]
pop ecx
or eax, eax
je 0x4027c1
mov dword [ecx], eax
ret

Function at 0x402838
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x481004]
test ecx, ecx
je 0x402848
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402861]
jns 0x40285c
call fcn.00406af8
mov eax, dword [eax + 4]
jmp fcn.00403b50

Function at 0x4029c0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4029ef
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403c40
jmp 0x402a0d
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402948
mov edi, eax
test ebx, ebx
je 0x402a0d
cmp dword [esi], 0
je 0x402a0d
dec ebx
jmp 0x4029f6
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402de0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402e78
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402e58
xor eax, eax
push ebp
push 0x402e51
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402e94
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e58
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x4030f8
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x403112
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x403112
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x4030fe
mov al, 0xa
jmp fcn.00402838
ret

Function at 0x403144
Capabilities:
Terminate process

Disassembly:
cmp dword [0x481018], 0
je 0x402a63
call dword [0x481018]
mov eax, 0xd2
jmp fcn.00403b50
push eax
push ecx
mov eax, dword [eax]
call fcn.00403114
pop ecx
pop eax
je 0x403153
jmp ebx
pop ecx
jmp 0x402a54
Function at 0x40315c
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00403114
mov eax, ebx
pop ebx
jne 0x403171
pop ecx
jmp 0x402a54
ret

Function at 0x403a2c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4814a0
mov esi, 0x481034
mov edi, 0x481038
cmp byte [ebx + 0x24], 0
jne 0x403a5b
cmp dword [edi], 0
je 0x403a5b
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403a4a
cmp dword [0x48103c], 0
je 0x403aa2
call fcn.004039a8
cmp byte [0x481044], 0
je 0x403a88
mov edx, 0x47e024
mov eax, 0x481218
call fcn.00406394
call fcn.00406317
jmp 0x403a9b
push 0
push 0x47e044
push 0x47e024
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x48103c], eax
cmp byte [ebx + 0x24], 2
jne 0x403ab2
cmp dword [esi], 0
jne 0x403ab2
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.0040387c
cmp byte [ebx + 0x24], 1
jbe 0x403ac2
cmp dword [esi], 0
je 0x403adf
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403adf
call fcn.00405d98
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x403adf
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.00403854
cmp byte [ebx + 0x24], 1
jne 0x403aed
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403af8
call fcn.004039f8
cmp dword [ebx], 0
jne 0x403b05
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403aa2

Function at 0x4041c0
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00404184
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00404184
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x40416c
ret

Function at 0x404268
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.00402838
test ecx, ecx
je fcn.00404184
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x40416c
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x404330
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40436f
cmp al, 0xb
je 0x40436f
cmp al, 0xc
je 0x404379
cmp al, 0xd
je 0x40438c
cmp al, 0xe
je 0x4043aa
cmp al, 0xf
je 0x40436f
cmp al, 0x11
je 0x40436f
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402838
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40436f
jmp 0x4043be
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x404379
jmp 0x4043be
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404330
dec edi
jg 0x40438f
pop ebp
jmp 0x4043be
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404304
dec edi
jg 0x4043ad
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4043c4
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404330

Function at 0x4043fc
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x404443
cmp al, 0xb
je 0x40445d
cmp al, 0xc
je 0x404474
cmp al, 0xd
je 0x404483
cmp al, 0xe
je 0x4044a1
cmp al, 0xf
je 0x4044b7
cmp al, 0x11
je 0x4044c6
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00402838
cmp ecx, 1
mov eax, ebx
jg 0x404454
call fcn.00403b5c
jmp 0x4044d5
mov edx, ecx
call fcn.00403b80
jmp 0x4044d5
cmp ecx, 1
mov eax, ebx
jg 0x40446b
call fcn.00404184
jmp 0x4044d5
mov edx, ecx
call fcn.0040419c
jmp 0x4044d5
mov eax, ebx
add ebx, 0x10
call fcn.00405144
dec edi
jg 0x404474
jmp 0x4044d5
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004043fc
dec edi
jg 0x404486
pop ebp
jmp 0x4044d5
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004043d0
dec edi
jg 0x4044a4
pop ebp
jmp 0x4044d5
mov eax, ebx
add ebx, 4
call fcn.00405e60
dec edi
jg 0x4044b7
jmp 0x4044d5
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.004059f4
dec edi
jg 0x4044c6
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x4044dc
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.004043fc

Function at 0x4044e8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x404514
mov edx, eax
add eax, esi
add edx, ebx
call fcn.00402908
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x404553
cmp cl, 0xb
je 0x404564
cmp cl, 0xc
je 0x404575
cmp cl, 0xd
je 0x404586
cmp cl, 0xe
je 0x4045a6
cmp cl, 0xf
je 0x4045bf
cmp cl, 0x11
je 0x4045d0
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402838
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403bb0
mov eax, 4
jmp 0x4045e1
mov edx, dword [esi + eax]
add eax, ebx
call fcn.004041c0
mov eax, 4
jmp 0x4045e1
lea edx, [esi + eax]
add eax, ebx
call fcn.004048a4
mov eax, 0x10
jmp 0x4045e1
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.00404604
pop eax
jmp 0x4045e1
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.004044e8
pop eax
jmp 0x4045e1
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405e78
mov eax, 4
jmp 0x4045e1
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405a30
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x404502
pop ecx
sub ecx, eax
jle 0x4045fd
lea edx, [ebx + eax]
add eax, esi
call fcn.00402908
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x404604
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x40464a
cmp cl, 0xb
je 0x404661
cmp cl, 0xc
je 0x404675
cmp cl, 0xd
je 0x404689
cmp cl, 0xe
je 0x4046aa
cmp cl, 0xf
je 0x4046c7
cmp cl, 0x11
je 0x4046db
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402838
mov eax, ebx
mov edx, dword [esi]
call fcn.00403bb0
add ebx, 4
add esi, 4
dec ebp
jne 0x40464a
jmp 0x4046ef
mov eax, ebx
mov edx, dword [esi]
call fcn.004041c0
add ebx, 4
add esi, 4
dec ebp
jne 0x404661
jmp 0x4046ef
mov eax, ebx
mov edx, esi
call fcn.004048a4
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x404675
jmp 0x4046ef
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.00404604
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x404692
jmp 0x4046ef
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.004044e8
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x4046aa
jmp 0x4046ef
mov eax, ebx
mov edx, dword [esi]
call fcn.00405e78
add ebx, 4
add esi, 4
dec ebp
jne 0x4046c7
jmp 0x4046ef
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00405a30
add ebx, 4
add esi, 4
dec ebp
jne 0x4046db
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x4048a4
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402838
cmp eax, edx
je 0x40493b
cmp word [eax], 8
jb 0x4048dc
push eax
push edx
cmp word [eax], 0x100
je 0x4048d2
cmp word [eax], 0x101
je 0x4048ca
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x4048da
call dword [0x4813e4]
jmp 0x4048da
add eax, 8
call fcn.00403b5c
pop edx
pop eax
cmp word [edx], 8
jae 0x4048f3
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x40490e
cmp word [edx], 0x101
jne 0x404927
push eax
call 0x4048e2
pop eax
jmp dword [0x4813ec]
mov edx, dword [edx + 8]
or edx, edx
je 0x40491e
mov ecx, dword [edx - 8]
inc ecx
jle 0x40491e
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x404858
ret

Function at 0x404d3c
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 8
jne 0x404d4a
mov edx, dword [edx + 8]
jmp fcn.004041c0
push ebx
mov ebx, eax
sub esp, 0x10
mov word [esp], 0
mov eax, esp
mov ecx, 8
call fcn.00404ab4
mov eax, ebx
mov edx, dword [esp + 8]
call fcn.00404174
add esp, 0x10
pop ebx
ret
Function at 0x404ecc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
lea eax, [ebp - 0x10]
call fcn.0040514c
xor eax, eax
push ebp
push 0x404ebe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call dword [0x4813e8]
mov eax, ebx
lea edx, [ebp - 0x10]
call fcn.00404ecc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ec5
lea eax, [ebp - 0x10]
call fcn.00405144
ret
cmp word [edx], 0x101
je 0x404e68
cmp word [edx], 0x100
jne fcn.004048a4
cmp word [eax], 8
jb 0x404ef1
push eax
push edx
call fcn.00404860
pop edx
pop eax
mov word [eax], 8
add eax, 8
add edx, 8
xor ecx, ecx
mov edx, dword [edx]
mov dword [eax], ecx
jmp fcn.0040428c

Function at 0x405034
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov esi, edx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x40505a
cmp eax, 0x100
jne 0x405089
mov eax, 8
cmp edx, 0x11
jbe 0x40506c
cmp edx, 0x100
jne case.default.0x405080
mov edx, 8
mov al, byte [eax + 0x47e05c]
mov dl, byte [edx + 0x47e05c]
movzx ecx, byte [edx + eax*8 + 0x47e070]
jmp dword [ecx*4 + 0x40509b]
mov eax, edx
cmp eax, 0x101
jne case.0x405080.0
pop edi
pop esi
call fcn.00404fa0
push eax
popf
ret
pop edi
pop esi
jmp 0x404858
cmp al, dl
pop edi
pop esi
ret
mov eax, esi
call fcn.00404ba8
xchg edi, eax
call fcn.00404ba8
cmp eax, edi
pop edi
pop esi
ret
mov eax, edi
call fcn.00404c48
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00404c48
fld xword [esp]
add esp, 0xc
fcompp
fnstsw ax
mov al, ah
and ax, 0x4001
ror al, 1
or ah, al
sahf
pop edi
pop esi
ret
mov eax, edi
call fcn.00404ca4
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00404ca4
fld xword [esp]
add esp, 0xc
jmp 0x4050f3
mov eax, edi
mov edx, esi
call fcn.00404f38
cmp eax, 0
pop edi
pop esi
ret
mov eax, esi
call fcn.00404c14
xchg edi, eax
call fcn.00404c14
mov edx, edi
cmp al, dl
pop edi
pop esi
ret
Function at 0x405ab4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405c6c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405b15
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405c88
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405b82
xor eax, eax
push ebp
push 0x405b7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405b64
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405ca8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b82
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405c63
cmp byte [ebp - 0xd], 0
jne 0x405bc4
cmp byte [ebp - 0x12], 0
je 0x405c63
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405bdd
dec ebx
cmp byte [ebx], 0x2e
je 0x405bec
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405bdc
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405c63
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405c19
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405c63
cmp byte [ebp - 0xd], 0
je 0x405c63
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405c63
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b394
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b3cd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403c40
jmp 0x40b3d6
mov eax, ebx
mov edx, esi
call fcn.00403bf4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b3e0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b401
mov al, byte [esp]
jmp 0x40b403
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x41943c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x419442
ret

Function at 0x41b964
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41b9b5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41b99c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41b98c
jmp 0x41b9b5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41b99d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e590
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x42e5c1
je 0x42e61b
sub eax, 7
je 0x42e5e2
dec eax
je 0x42e60c
sub eax, 0x17
je 0x42e69c
jmp 0x42e6da
add eax, 0xffffff00
sub eax, 9
jb 0x42e688
add eax, 0xffffff09
sub eax, 0xb
jb 0x42e672
jmp 0x42e6da
mov eax, ebx
call fcn.0043f094
mov edi, eax
test edi, edi
je 0x42e73a
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xc8]
test al, al
je 0x42e743
jmp 0x42e73a
test byte [ebx + 0x44], 0x20
jne 0x42e743
jmp 0x42e73a
mov edx, esi
mov eax, ebx
call fcn.0042be7c
cmp dword [esi + 0xc], 0xffffffff
jne 0x42e743
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00407640
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.0042a924
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.0042e440
test eax, eax
je 0x42e743
mov dword [esi + 0xc], 1
jmp 0x42e743
mov edx, esi
mov eax, ebx
call fcn.0042e504
test al, al
jne 0x42e743
jmp 0x42e73a
mov eax, ebx
call fcn.0042b4f4
test al, al
jne 0x42e743
jmp 0x42e73a
mov eax, ebx
call fcn.00430ac0
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x42e73a
cmp dword [0x47e7a8], 0
je 0x42e73a
mov eax, dword [0x47e7a8]
cmp ebx, dword [eax + 0x24]
jne 0x42e73a
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x47e7a8]
call fcn.0042bd98
jmp 0x42e73a
mov eax, dword [0x481724]
cmp byte [eax + 0x20], 0
je 0x42e73a
mov eax, dword [0x481724]
cmp dword [eax + 0x1c], 0
je 0x42e73a
mov eax, dword [esi]
mov edx, dword [0x481724]
cmp eax, dword [edx + 0x1c]
jne 0x42e73a
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.0043efa8
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb9
call fcn.00403144
jmp 0x42e743
mov edx, esi
mov eax, ebx
call fcn.0042be7c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42ebd4
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x42ebf0
cmp dword [esi + 4], 0
je 0x42ec1d
test byte [ebx + 0x45], 1
jne 0x42ec0f
mov eax, ebx
call fcn.0042dc44
test eax, eax
jne 0x42ec0f
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x42ed2d
mov edx, esi
mov eax, ebx
call fcn.0042e84c
jmp 0x42ed2d
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42ed26
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00430ac0
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0042bd98
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0042ebd4
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00430ac0
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ed2d
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x438a7c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403b5c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x438add
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x438add
cmp byte [ebp - 0x102], 0
je 0x438add
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403d88
pop ebx
mov esp, ebp
pop ebp
ret