joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7915daf1
Capabilities:
Encrypt data using tea

Disassembly:
call fcn.7917049c
stc
bt ebx, 0x1e
cmp bh, al
movzx eax, al
cmp al, dl
cmc
test eax, eax
pushfd
push 0x85029806
lea esp, [esp + 8]
je 0x790b1c8a
pushfd
mov dword [0x7906f500], 0
movsx dx, bl
lea eax, [ebx - 0x6139bd32]
setp ah
movzx ax, cl
mov eax, 1
lea edx, [edx - 0x4be60c27]
lea edx, [ebx - 0x47958da6]
imul ecx, eax, 0xf
mov edx, dword [esp]
push 0x9b0e78a
call fcn.79081158
cmp dword [ecx + eax], 0
lea esp, [esp + 8]
jge 0x790cac43
pushal
push 0xd197f36
pushfd
lea esp, [esp + 0x28]
jne 0x790c5d17
rol ah, cl
cmp al, ah
mov eax, 1
or dl, 0x38
shl eax, 3
xor dl, 0x2e
shr cl, cl
bsr cx, dx
stc
mov ecx, dword [ebp - 0x10]
mov dh, bl
xor dx, 0x4348
btc dx, 9
lea edx, [eax*4 + 0x324ff4dd]
movzx edx, word [ecx + eax]
cmp cx, 0x4cab
cmc
clc
pushal
cmp edx, 0x816
pushfd
lea esp, [esp + 0x24]
jne 0x790c5d17
and al, 0x7a
btc eax, 0x14
rcr al, cl
movzx eax, byte [0x7907031c]
stc
call fcn.7915e311
lea esp, [esp + 0x54]
call fcn.7915a046
jmp 0x790a73a8
cmc
clc
mov eax, 1
push 0x815bf610
pushfd
rcl cl, 4
imul ecx, eax, 0xf
sub esp, 0xfffffff8
aas
aaa
cmp cl, 0x39
mov edx, dword [ebp + 8]
call fcn.790e7cea
jmp 0x7916a76a
inc ch
stc
mov ecx, dword [ebp - 0x10]
push ebx
jmp 0x790ac46e

Function at 0x79161eeb
Capabilities:
Encrypt data using tea

Disassembly:
lea esp, [esp + 0x44]
movss dword [ebp - 0x68], xmm0
jmp 0x7911a2d4

Function at 0x79165761
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov dword [esp + 0x24], eax
call fcn.7918626a

Function at 0x79166258
Capabilities:
Encrypt data using tea

Disassembly:
movss xmm0, dword [ebp + eax - 0x40]
push 0x5684fd2
lea esp, [esp + 4]
ucomiss xmm0, dword [0x79059738]
pushfd
lahf
mov dword [esp], esp
pushfd
pushal
lea esp, [esp + 0x28]
jmp fcn.790860ef
lea eax, [edx*2 - 0x5ba73d94]
mov eax, dword [ebp - 0x10]
pushal
push dword [esp]
mov dword [esp + 0x28], eax
call fcn.7914838c
shl eax, 0
jmp 0x790be892

Function at 0x791662e1
Capabilities:
Packed with generic packer

Disassembly:
pushfd
call fcn.7908caf7
cwde
setg ah
pop ecx
lea eax, [ebp - 0x300]
not cl
bswap ecx
push eax
movzx cx, bl
lea ecx, [ebp - 0x324]
js 0x790e1e32
jmp 0x7907adea
Function at 0x791667cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr cx, cl
sub eax, 0x6ff20000
not dl
mov dword [ebp - 0x78], eax
movzx eax, al
pushfd
movzx eax, byte [ebp - 0x11]
xchg dh, ch
not cl
xchg dword [esp], eax
seto dh
push 0
setns cl
not dx
lea ecx, [esi*8 - 0x1eb0443c]
movsx dx, cl
mov ecx, dword [ebp - 0xc]
cwde
bswap dx
call fcn.791773eb
cmp dword [ebp - 8], 0
lea esp, [esp + 0x28]
jns 0x79099d2d
setge dl
movzx ecx, dl
dec eax
dec dl
mov ecx, 0xbfb5f5c8
sal cx, 4
xchg dx, cx
or eax, 0xffff0000
lea edx, [ecx - 0x6c5f624]
pushal
mov dx, di
pop edx
inc eax
bt edx, 3
btc edx, 0xf
setnp dh
sub eax, 0x6ff20000
pushfd
xchg dh, ch
pushal
movsx cx, cl
mov dword [ebp - 0x78], eax
push 0xa7c2048a
bswap dx
movzx eax, byte [ebp - 0x11]
movzx dx, al
lea ecx, [ebp*8 - 0x605d47db]
xchg dword [esp + 0x40], eax
lea eax, [ebp - 0x46940567]
mov dword [esp + 0x3c], 0
rdtsc
mov dword [esp + 8], esp
lea edx, [eax - 0x473e1eb6]
not ch
mov ecx, dword [ebp - 0xc]
cwde
setl al
mov dword [esp + 0x38], ecx
movzx dx, bl
rdtsc
jmp 0x7916aff3
movzx dx, bl
mov edx, dword [ebp - 0x6c]
not ch
movzx ax, al
mov dword [esp + 0x34], edx
lea eax, [ecx + 0x637298af]
bswap ax
movzx ax, dl
mov eax, dword [ebp - 0x68]
call fcn.7914b43f
add esp, 8
pushfd
bt ax, bx
mov byte [ebp - 0x39], al
stc
pushal
cmp dword [ebp - 0x1c], 0xbbd1
pushfd
mov byte [esp], 0x14
jmp 0x790b2e6f

Function at 0x7916914f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x10f], 0x31
movzx eax, dl
ror ax, cl
cmp cl, al
mov byte [ebp - 0x10e], 0x12
btr ax, 4
shr ax, cl
dec ax
sal ax, 1
mov byte [ebp - 0x10d], 0x89
das
mov byte [ebp - 0x10c], 0xfc
pop eax
mov byte [ebp - 0x10b], 0x97
sbb eax, 0x9210b860
stc
mov ax, bp
mov byte [ebp - 0x10a], 0x3a
bswap ax
mov byte [ebp - 0x109], 0x34
aaa
mov byte [ebp - 0x108], 0x12
sar al, 3
bsf ax, bp
mov byte [ebp - 0x107], 0x8e
mov byte [esp + 4], dl
pushal
bsf eax, edx
mov byte [ebp - 0x106], 0x6c
clc
mov byte [ebp - 0x105], 0x87
bt di, 1
mov byte [ebp - 0x104], 6
bsf ax, di
aas
mov byte [ebp - 0x103], 0x37
stc
aam 0xed
mov byte [ebp - 0x102], 0x12
clc
mov byte [ebp - 0x101], 0xaa
das
sbb ax, ax
mov byte [ebp - 0x100], 0xae
clc
dec ax
mov word [esp], si
mov byte [ebp - 0xff], 0xfe
stc
aas
mov byte [ebp - 0xfe], 0x9a
bt sp, 2
add ah, 0x8d
sal ax, 1
mov byte [ebp - 0xfd], 0x3a
inc ah
mov byte [ebp - 0xfc], 0x12
setle ah
mov byte [ebp - 0xfb], 0x41
cmc
sbb ah, dl
mov byte [ebp - 0xfa], 0xa9
setl ah
bsf ax, di
adc ah, al
mov byte [ebp - 0xf9], 0x3b
setg al
neg eax
lea eax, [eax*8 + 0x6d33a675]
shl ah, cl
mov byte [ebp - 0xf8], 0xa5
aaa
mov byte [ebp - 0xf7], 0x3d
mov word [esp], ax
adc al, 0x10
mov byte [ebp - 0xf6], 0x12
mov eax, 0x858250f4
lahf
bsf ax, bx
cmp bp, bp
mov byte [ebp - 0xf5], 0x22
not ax
cmp sp, bp
mov byte [ebp - 0xf4], 0x91
shr ax, 0xd
jmp 0x790a6e97
Function at 0x7916a448
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
jne 0x790aa1b9
push ebx
test dh, 0xab
call fcn.79154e88
push 0x8cd685ff
push dword [esp + 4]
pushfd
lea esp, [esp + 0x14]
je 0x7915bb28
and cl, al
mov ecx, dword [ebp - 0x30]
cmp dl, 0x92
cmp ecx, dword [ebp - 0x2c]
call fcn.790b231f
jmp 0x790aaf8d

Function at 0x7916b13a
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x24]
je 0x790dacaa
jmp 0x79185758
test ax, di
bt ebx, 5
test dh, ah
cmp dword [ebp + 8], 0xd37d
pushal
pushal
lea esp, [esp + 0x40]
je 0x790dacaa
call fcn.790d3de9

Function at 0x79170da7
Capabilities:
Encode data using xor

Disassembly:
pushal
push ecx
lea esp, [esp + 0x28]
subss xmm0, dword [ebp - 0x34]
push 0xf60e7ab8
pushal
mov dword [esp + 0x20], ecx
jmp 0x790b9583

Function at 0x7917197c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
bt ecx, 0x17
add eax, 0xd
jmp 0x7918f74c

Function at 0x791773c7
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov byte [esp + 8], 0xae
lea esp, [esp + 0x28]
jne 0x79139aaa
call fcn.7907f2c2
Function at 0x7917a8ac
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov dword [esp], eax
jmp 0x790eca65
pushfd
lea esp, [esp + 4]
call fcn.7902c570
lea ecx, [ecx + 0x77215b30]
mov byte [ebp - 4], 4
pushfd
lea ecx, [esp - 0x7b6070ec]
lea ecx, [esp - 0x6bc59814]
movzx cx, al
lea ecx, [ebp - 0x120]
call fcn.790d0043
dec esp
mov eax, dword [0x13a054f3]
add ebp, eax
mov bl, 0x5e
cmpsb byte [esi], byte es:[edi]
cmp ch, byte [edi + 0x5a8a5c]
pop ss
popal
mov bl, 0x59
mov ch, 0xbe
pop ebp
das
fucom st(6)
jmp dword [eax - 0x47]
mov ecx, dword [ebp + 0x20]
jmp 0x790a9b31
lea esp, [esp + 0x44]
call fcn.7902af70
movzx ax, bl
lea eax, [ebp - 0x120]
jne 0x79084c97
not cl
pushfd
mov dword [esp], eax
pushal

Function at 0x7917e6fd
Capabilities:
Encrypt data using tea

Disassembly:
not cl
lea ecx, [ebp - 0x74]
push 0x215616b1
call fcn.7913ee93
push 0x1457648b
pushal
lea esp, [esp + 0x24]
jge 0x790d3f9b
movsx ax, dl
mov eax, 1
push edi
pushfd
movsx si, bl
imul ecx, eax, 0
bsf dx, ax
mov edx, dword [ebp - 0x14]
dec al
mov al, byte [edx + ecx]
btr cx, 8
mov byte [ebp - 0x2d], al
xchg ah, dl
mov eax, 1
bsr cx, ax
sbb cx, ax
shl eax, 0
pop esi
bswap si
mov ecx, dword [ebp - 0x14]
pushfd
jmp 0x7911a289
seto cl
mov dword [ebp - 4], 0xffffffff
call fcn.790b75fd
mov word [esp + 4], cx
lea esp, [esp + 0x44]
call fcn.79018ba0
pushfd
cmc
cmc
mov dword [eax], esi
sub ax, 0x40ac
ror ah, 2
bsf ax, di
or al, 9
mov eax, dword [ebp - 0x14]
mov dword [esp], 0x91b1ac77
add eax, 2
pushfd
pushfd
mov byte [esp + 4], cl
mov dword [ebp - 0x14], eax
mov dword [esp + 8], edi
lea esp, [esp + 0xc]
jmp 0x7914f343
mov dl, byte [ecx + eax]
mov eax, ecx
pushal
mov byte [ebp - 0x2e], dl
xchg si, ax
movzx eax, byte [ebp - 0x2d]
movzx si, cl
lea ecx, [edi - 0x488384d6]
sete ch
lea esi, [ecx*2 - 0x1caa6639]
mov dword [ebp - 0x74], eax
mov ecx, 0xa47d12db
push 0x365cbcf6
movsx esi, cl
movzx esi, byte [ebp - 0x2e]
lea esp, [esp + 0x2c]
js 0x79019fef
pushfd
lea ecx, [ebp - 0x74]
pushfd
call fcn.7918132f
push 0x642670a9
lea esp, [esp + 4]
movss xmm0, dword [ebp - 0x68]
pushal
lea esp, [esp + 0x20]
comiss xmm0, dword [ebp - 0x70]
call fcn.790d69f7
push dword [esp]
xor ecx, 0xe1ff9487
call fcn.79152cd1
jmp 0x79075104
neg ax
movzx ax, bl
mov eax, dword [ebp - 0x2c]
push 0xad302fd2
add eax, 1
sub esp, 0xfffffffc
jl 0x790a7ff5
test ebx, 0x5e767eab
mov dword [ebp - 0x2c], eax
aas
daa
mov eax, dword [ebp - 0x2c]
clc
cmp eax, dword [ebp - 0x1c]
jmp 0x79135423
pushal
lea ecx, [ebp - 0x24]
jmp 0x790f38e4

Function at 0x7918132f
Capabilities:
Encrypt data using tea

Disassembly:
lea esp, [esp + 4]
call fcn.79018ba0
jmp 0x79125c0d
cmc
push eax
pushfd
mov dword [eax], esi
lea eax, [ebp*4 + 0x72279159]
movzx ax, bl
mov eax, dword [ebp - 0x14]
clc
clc
add eax, 2
push 0x5710337
push dword [esp + 8]
push dword [esp + 8]
mov dword [ebp - 0x14], eax
pushfd
lea esp, [esp + 0x18]
jmp 0x7914f343
lea esp, [esp + 0xc]
jnp 0x7915a6f3
push ecx
pushfd
movzx cx, dl
lea ecx, [ebp - 0x24]
jmp 0x790a54c4
Function at 0x79181bcc
Capabilities:
Packed with generic packer

Disassembly:
pushal
pushfd
pop dword [esp + 0x20]
bt cx, di
pushal
xor dword [esp + 0x40], 0x8c0
test di, cx
cmp dh, 0x35
xor esi, 0xf5f8bed3
cmc
xor edx, 0xf02aac98
test ah, 0xa9
xor ecx, 0x6e57f5b7
cmp di, si
xor eax, 0x828db8a
push 0xea9f4f8f
bt cx, bx
xor ebp, 0xf38846f6
cmc
call fcn.7912ba5a

Function at 0x79185736
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp], sp
pushal
lea esp, [esp + 0x30]
call fcn.7918e058
mov cx, di
add esp, 4
rcr ch, cl
btr ecx, 0x18
setno cl
call fcn.790fca8a

Function at 0x791866b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7915324c
mov dword [esp + 4], eax
jmp 0x79085362

Function at 0x79187541
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x790db5b7
push ebx
ror dl, 3
push esi
rol dh, 1
stc
pushal
mov dword [esp + 0x1c], edi
lea edx, [ebp*4 + 0x72b541e9]
not dl
xchg dword [esp + 0x18], eax
bswap dx
lahf
rdtsc
not dx
lea eax, [ebp - 0x10]
rcl dx, 0xd
mov dword fs:[0], eax
btc dx, 1
btc dx, di
lea esp, [esp + 0x18]
mov dword [ebp - 0x18], esp
lea edx, [edi*8 + 0x649da20]
mov dword [ebp - 0x20], ecx
lahf
wait
cwde
ror ax, 1
rdtsc
mov dword [ebp - 4], 0
jmp 0x79101084
rdtsc
mov eax, 4
ror dl, 4
bt ax, 5
xchg ch, dl
imul ecx, eax, 0
not dh
movzx edx, dl
push eax
call fcn.790edfd8
mov dword [esp], 0x7903cef0
shr dl, 7
pushfd
stc
mov eax, dword fs:[0]
pushfd
neg dl
pushfd
bsr dx, si
xchg dword [esp + 8], eax
cmp al, dh
aam 0x57
add esp, 0xffffff94
dec dl
btc ax, 0xb
mov eax, dword [0x79068330]
shr edx, cl
sub dx, di
btc dx, ax
xor dword [ebp - 8], eax
or dh, ch
xor eax, ebp
btc edx, 8
rcr edx, cl
ror edx, cl
mov dword [ebp - 0x1c], eax
jmp 0x79084d84

Function at 0x791895a2
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
je 0x790dacaa
stc
call fcn.790c0fd3

Function at 0x791899e9
Capabilities:
Encrypt data using tea

Disassembly:
cmp dword [ebp + 8], 0
pushfd
pushfd
mov dword [esp], eax
lea esp, [esp + 0xc]
jne 0x79160d45
call fcn.791719c2
mov word [esp + 4], di
mov dword [esp + 4], esi
mov esp, ebp
lea ebp, [eax - 0x5d2377f5]
jmp fcn.7902ec3e
lea esp, [esp + 0x48]
movss xmm0, dword [ebp + eax - 0x18]
pushal
lea esp, [esp + 0x20]
movss dword [ebp - 0x34], xmm0
cmp dh, 0xe6
push 0xc44dffe5
jmp 0x7912a4db

Function at 0x7918e4c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], 0x26d6
mov dword ss:[ebp - 4], 0
mov byte [esp + 4], 0x2b
pushfd
pushfd
mov dword [esp + 4], esp
mov dword ss:[ebp - 0xc], 0
call fcn.79095596

Function at 0x7918e4e7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
call fcn.7903a2c0
pushfd
lea esp, [esp + 4]
jmp 0x79153255

Function at 0x7918ed22
Capabilities:
Encrypt data using tea

Disassembly:
pushfd
mov word [esp + 8], 0xedca
mov dword [ebp - 0x2c], 0
pushfd
mov word [esp], 0xbd3c
push dword [esp]
pushfd
lea esp, [esp + 0x38]
jmp 0x7914f367
Function at 0x4062d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40633a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004046a8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004030c4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406324
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406341
lea eax, [ebp - 0x10]
call fcn.00404438
ret

Function at 0x408d78
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004048f8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408d91
test al, 0x10
jne 0x408d95
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40b9d8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ba11
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404528
jmp 0x40ba1a
mov eax, ebx
mov edx, esi
call fcn.0040448c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ba24
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ba45
mov al, byte [esp]
jmp 0x40ba47
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ca44
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cb1a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004044d0
lea eax, [ebp - 8]
call fcn.00404948
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004048f8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40cb04
mov eax, ebx
call fcn.00402a38
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40cafd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004048f8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40cae7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40cb2c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40cae7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cb04
mov eax, dword [ebp - 0x10]
call fcn.00402a68
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cb21
lea eax, [ebp - 8]
call fcn.00404438
ret
Function at 0x40d068
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d0cc
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004046a8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004089d8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d0d3
lea eax, [ebp - 0xc]
call fcn.00404438
ret

Function at 0x41e8e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x45d888
cmp dword [edi], 0
jne 0x41e95c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x45d884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x45b47c
mov ecx, 2
call fcn.00402c58
mov edx, 0x41e8b8
lea eax, [esi + 5]
call fcn.0041e8d8
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041e8d8
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41e931
mov dword [0x45d884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41fb70
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41fb76
ret

Function at 0x421fe8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x422039
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x422020
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x422010
jmp 0x422039
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x422021
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d4b0
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x42d3fc
call sub.user32.dll_EnumWindows
ret

Function at 0x42d5d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x42d64d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0042d030
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x42d5f5
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0042cc30
cmp dword [ebp - 4], 0
je 0x42d637
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004048f8
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d654
lea eax, [ebp - 4]
call fcn.00404438
ret

Function at 0x43036c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x45db58], 0
je 0x4304bb
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x45c898]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x4304bb
mov eax, dword [0x45db5c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x45db58]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x43048a
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x45db58]
call fcn.00417a64
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x430482
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x430482
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x430482
mov eax, dword [ebp - 0x14]
call fcn.00438fa8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x430482
push ebp
call fcn.00430328
pop ecx
test al, al
jne 0x430482
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x43043e
mov eax, dword [ebp - 0x14]
call fcn.00437ad8
dec eax
jle 0x430482
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004038cc
cmp byte [ebp - 1], 0
je 0x430482
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x430482
mov edx, dword [ebp - 0x14]
mov eax, dword [0x45db5c]
call fcn.0042faf4
inc edi
dec ebx
jne 0x4303d1
mov eax, dword [0x45db5c]
cmp dword [eax + 8], 0
jle 0x4304a2
mov eax, dword [0x45db5c]
call fcn.0042fb84
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4304bb
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00430190
pop ecx
test al, al
jne 0x4304bb
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433a80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x433acc
mov eax, esi
call fcn.00449054
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x433acc
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x433acc
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x433c0b
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x433b0c
cmp eax, 0x108
ja 0x433b0c
mov eax, esi
call fcn.00449054
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x433c02
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x433c0b
jmp 0x433c02
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x433beb
cmp eax, 0x20a
ja 0x433beb
test byte [esi + 0x50], 0x80
jne 0x433b3e
sub eax, 0x203
je 0x433b3b
sub eax, 3
je 0x433b3b
sub eax, 3
jne 0x433b3e
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x433b52
dec eax
je 0x433b67
dec eax
je 0x433b84
dec eax
je 0x433b67
jmp 0x433b8b
mov ecx, ebx
mov eax, dword [0x45c898]
mov eax, dword [eax]
mov edx, esi
call fcn.0045292c
jmp 0x433c02
cmp byte [esi + 0x5d], 1
jne 0x433b7d
mov eax, esi
mov si, 0xffed
call fcn.004038cc
jmp 0x433c0b
or word [esi + 0x54], 1
jmp 0x433c02
and word [esi + 0x54], 0xfffe
jmp 0x433c02
mov eax, dword [0x45db14]
cmp byte [eax + 0x20], 0
je 0x433c02
mov eax, dword [0x45db14]
cmp dword [eax + 0x1c], 0
je 0x433c02
mov eax, dword [ebx]
mov edx, dword [0x45db14]
cmp eax, dword [edx + 0x1c]
jne 0x433c02
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00448f98
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.004038cc
jmp 0x433c0b
cmp eax, 0xb00b
jne 0x433c02
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.004323bc
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret