joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ddfd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov ebx, 0x5b2cb4
mov eax, ebp
shr eax, 1
and eax, 0xff
mov dword [esp], eax
mov esi, ebp
and esi, 1
mov eax, ebp
and eax, 0x200
shr eax, 8
or esi, eax
mov edx, dword [esi*4 + reloc.MSVCRT.dll_strncpy]
mov eax, dword [esi*4 + reloc.MSVCRT.dll_strncpy]
xor eax, dword [esp]
call fcn.004ddf70
mov edi, eax
shl edi, 0x18
mov eax, edi
call fcn.004ddfac
mov dword [ebx], eax
mov edx, dword [esi*4 + reloc.MSVCRT.dll_strncpy]
mov eax, dword [esi*4 + reloc.MSVCRT.dll_strncpy]
xor eax, dword [esp]
call fcn.004ddf70
mov edi, eax
shl edi, 0x10
mov eax, edi
call fcn.004ddfac
mov dword [ebx + reloc.MSVCRT.dll_strncpy], eax
mov edx, dword [esi*4 + reloc.MSVCRT.dll_strncpy]
mov eax, dword [esi*4 + reloc.MSVCRT.dll_strncpy]
xor eax, dword [esp]
call fcn.004ddf70
mov edi, eax
shl edi, 8
mov eax, edi
call fcn.004ddfac
mov dword [ebx + reloc.MSVCRT.dll_strncpy], eax
mov edx, dword [esi*4 + reloc.MSVCRT.dll_strncpy]
mov eax, dword [esi*4 + reloc.MSVCRT.dll_strncpy]
xor eax, dword [esp]
call fcn.004ddf70
mov edi, eax
mov eax, edi
call fcn.004ddfac
mov dword [ebx + reloc.MSVCRT.dll_strncpy], eax
inc ebp
add ebx, 4
cmp ebp, 0x400
jne 0x4ddfe0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4de138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x4c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, 3
jne 0x4de16d
xor ebx, ebx
mov eax, ebx
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [eax + ecx]
and edx, 3
mov esi, dword [ebp - 8]
lea edx, [esi + edx*2]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
and dx, 1
movzx edx, dx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add esi, esi
or esi, edx
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
mov esi, dword [ebp - 0x1c]
movzx esi, word [esi]
shr esi, 1
xor dx, 1
shl edx, 0xf
or si, dx
mov edx, dword [ebp - 0x1c]
mov word [edx], si
inc eax
cmp eax, 4
jne 0x4de193
inc ebx
cmp ebx, 0xf
jne 0x4de17d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x4de14f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5d9a4c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf05cadd8
jmp 0x5d9943
lea esp, [esp]
lea esp, [esp + 1]
mov dword [esp + 0x1c], edi
lea esp, [esp + 0x1c]
pushfd
jmp 0x5d98ba
pop word [esp + 0x1f]
lea esp, [esp + 2]
mov dword [esp + 0x20], esi
push bp
push dx
lea esp, [esp + 3]
jmp 0x5d9959
push si
mov byte [esp], dh
lea esp, [esp + 2]
mov dword [esp + 4], ebp
pushfd
pushal
jmp 0x5d9992
lea esp, [esp + 1]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esp
jmp 0x5d99d4

Function at 0x5d9b5f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
lea esp, [esp]
call fcn.005d9a4c

Function at 0x5da23b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xc], edx
call fcn.005d9b5f
xchg dh, dl
lea esp, [esp + 2]
call fcn.005d9c75
mov ch, 0x27
mov bh, 0xd2
and dword [ebx + reloc.MSVCRT.dll_strncpy], ebx
mov esi, 0x648dd686
and al, 2
rol edi, 0
shr eax, 6
jl 0x5d9c40
pushal
mov cx, 0x490d
jmp 0x5d9c83
jmp 0x5d9c7e
pushal
mov cx, 0x490d
add edi, dword [esi]
jmp 0x5d9c8b
mov dl, 0xc7
sub esp, 6
js 0x5d9f2f
xchg dh, ah
jmp 0x5d9e7c
mov ecx, dword [esp + 4]
lea esp, [esp + 2]
jmp fcn.005d9cc2
xchg dh, ah
mov ecx, dword [esp + 4]
lea esp, [esp + 2]
jmp fcn.005d9cc2
push cx
mov word [esp + 7], bp
lea esp, [esp + 2]
jmp 0x5d9ba6

Function at 0x5e7db5
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x5ce996
pushfd
or dword [esp], reloc.MSVCRT.dll_strncpy
popfd
cpuid
nop
jmp 0x5ce9ad
pop ebx
ret
pop word [esp]
lea esp, [esp + 1]
pushfd
mov dword [esp], ebp
push word [esp]
jmp 0x5e7db7
jmp 0x5e7d9f
lea esp, [esp + 3]
mov dword [esp], eax
lea eax, [edi*4]
bswap eax
mov eax, 0x5174ac23
jmp 0x5e7df4
pushfd
setg ch
xchg word [esp + 1], ax
mov dword [esp], ebx
mov ebx, edi
jmp 0x5e7e38
mov ax, 0x872b
bswap eax
push ecx
lea eax, reloc.MSVCRT.dll_strncpy
mov ah, byte [esp]
setne cl
jmp 0x5e7dde
xchg ah, ch
lea ecx, [esp + ebp]
mov ah, dl
lea eax, [ebp*4]
pop ecx
jmp 0x5e7e4d
pop ebx
xchg ecx, eax
sete al
mov ch, cl
mov ax, 0x9a
setle ch
jmp 0x5e7e09
mov ecx, 0x38ffa7ad
mov ebx, eax
setp ch
setle cl
push di
lea esp, [esp + 2]
jmp 0x5e7e1f
mov ah, 0xae
setl al
lea eax, reloc.MSVCRT.dll_strncpy
not eax
mov eax, 0x14403ea
pop eax
jmp 0x5ce98a

Function at 0x5e8436
Capabilities:
Encode data using xor

Disassembly:
mov ax, si
xchg al, ah
pop ax
mov eax, 0x2058d294
jmp 0x5e8681
mov al, byte [esp]
bswap eax
pop edi
mov ax, 0x664d
bswap eax
lea eax, [esi + ebp]
call fcn.005e8491
mov ebp, dword [esp]
mov al, ah
mov edi, 0xf573537a
pop ebp
lea edi, [ebx*4]
bswap edi
jmp 0x5e84c6
lea esp, [esp + 2]
push ebp
mov edi, dword [esp]
mov edi, 0x6d92ae4b
mov bp, 0x8b5f
lea edi, [edx*4]
jmp 0x5e8595

Function at 0x720087
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, 0xe2c
jmp 0x7200b4
pop word [esp]
bsr esi, ebx
neg dh
mov byte [esp + 4], dl
jmp 0x72010d
mov al, byte [esp + 1]
mov ah, 0xb0
lea edi, reloc.MSVCRT.dll_strncpy
Function at 0x720503
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [ecx*4]
lea ecx, [edx + 0xed]
xchg byte [esp + 0xc], dh
jmp 0x7205b4
lea esp, [esp + 0x11]
rcr ecx, cl
lea edi, [edi*4]
dec bl
jmp 0x7205dd
bswap eax
clc
mov bp, word [esp + 0x1c]
neg cx
mov esi, dword [esp + 0x16]
ror bl, 3
jmp 0x720576
not dx
mov al, 0xf2
mov byte [esp + 0x14], dl
xchg byte [esp + 0x19], al
mov si, sp
clc
jmp 0x72058c
mov word [esp + 3], dx
setge ch
mov ebp, dword [esp + 6]
rdtsc
jmp 0x7207c4
rdtsc
mov ah, byte [esp + 0x12]
adc cl, dl
cpuid
lea edx, [esp - 0xde]
mov ah, dl
jmp 0x7205c7
mov ebp, 0x45ddf969
bsf si, dx
lea ebx, [edx + edi]
mov ecx, dword [esp + 9]
jmp 0x720640
mov byte [esp + 1], dh
mov cl, 0x23
cpuid
xchg byte [esp + 9], bh
dec edx
neg eax
jmp 0x720619
sub esp, 0x1e
lea esp, [esp + 0x16]
lea esp, [esp + 0xe]
bswap edx
xchg word [esp + 4], bp
cpuid
jmp 0x7206f9
xchg ebp, ebx
std
xchg si, di
cpuid
mov eax, dword [esp + 0xa]
not dl
jmp 0x72062f
mov dword [esp], edx
cpuid
mov ebp, 0x56c65600
adc ebp, esp
xchg ecx, ebx
pop ax
jmp 0x7206cd
rdtsc
clc
rcr ch, cl
add esp, 5
inc esi
mov ch, 0xcc
jmp 0x720675
rdtsc
mov ah, byte [esp]
push dx
sub bx, 0xf4b7
sub ax, cx
mov ebx, 0xae5c2958
jmp 0x720762
setnp cl
add esp, 1
lea esp, [esp]
lea eax, reloc.MSVCRT.dll_strncpy
rdtsc
lea ecx, [ecx*4]
jmp 0x7206a5
setbe al
bt cx, ax
push word [esp + 6]
bsf dx, si
bswap edi
cpuid
jmp 0x720698
mov bp, 0x19b9
mov edi, eax
sub esp, 4
and dx, 0x8eb5
lea esp, [esp + 0xc]
lea ebx, [eax + ebx]
jmp 0x72078a
pushal
not bp
xchg word [esp + 0x13], dx
pop word [esp + 0x10]
neg bl
lea edx, [edi*4]
jmp 0x72070f
dec di
xchg word [esp], bp
sete cl
lea esi, [ecx + 0x1c]
xchg edx, ebx
rdtsc
jmp 0x720734
bsf ecx, ecx
mov ecx, eax
cmc
xchg ah, bl
call fcn.0072079b
xchg ecx, eax
adc eax, 0xf41fec85
add al, 0xb7
sahf
pushfd
bt bx, di
neg bx
add esp, 0xc
mov eax, esp
not ecx
jmp 0x720774
xchg dword [esp + 0xd], ebx
pop dword [esp + 2]
bswap esi
pop word [esp + 4]
mov word [esp + 5], di
lea eax, [ecx + esi]
jmp 0x720665

Function at 0x7208cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ecx
push esi
jmp 0x7208d4
lea ecx, [eax + eax]
bswap edi
add bh, 0x62
cpuid
popal
add bx, di
jmp 0x7208ff

Function at 0x720a2c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ax
jmp 0x720a34
lea edx, [ebx*4]
neg cl
add esp, 8
neg bl
mov al, 0xea
xchg word [esp], bp
jmp 0x720a81
setno ah
add esp, 1
dec bp
add esp, 0
lea esi, [ebp - 0x6e]
mov ah, ch
jmp 0x720a6b

Function at 0x7210b6
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp]
lea esp, [esp + 3]
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0x7210f9
mov dword [esp + 0x28], esi
push esi
mov dword [esp], ebx
lea esp, [esp + 1]
jmp 0x7210a0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x7210dd
Function at 0x722a88
Capabilities:
Execute anti-debugging instructions

Disassembly:
popal
mov cx, word [esp]
sub esp, 0x14
mov edx, dword [esp + 0xf]
bswap esi
xchg al, ch
call fcn.0072112a
push ebx
aam 0x4a
sub eax, 0x41c73cdc
sal dword [eax + reloc.MSVCRT.dll_strncpy], 1
invalid
mov al, 0x43
scasd eax, dword es:[edi]
xchg dword [edx], eax
nop
test dword [edx], reloc.MSVCRT.dll_strncpy
xor al, cl
sub eax, 0x89ee78f3
js 0x7211b0
js 0x7211bc
mov dword [eax - 0x21], edi
fist word [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
mov dword [edi - 0x3a], ecx
push esp
xor ecx, esi
and ebx, edi
jnp 0x7211cb
invalid
push edi
neg cl
xchg dword [esp + 0xc], ebx
xchg dword [esp + 0x16], eax
xchg dword [esp + 0x1b], ebp
xchg dword [esp + 0x1b], edi
jmp 0x72119e
lea ecx, [esp + edx]
sub esp, 6
mov ch, 0x81
xchg word [esp + 0x14], bp
shl ebp, cl
lea eax, reloc.MSVCRT.dll_strncpy
jmp 0x7214f7
btc ecx, edx
mov al, 0x2b
pop dword [esp + 6]
rdtsc
rdtsc
push dword [esp + 5]
jmp 0x721675
lea eax, [esi + 0x47]
jmp 0x721b35
Function at 0x4029fc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403fb0
test esi, esi
jne 0x402a32
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004040a0
jmp 0x402a50
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402910
mov edi, eax
test esi, esi
je 0x402a50
cmp dword [ebx], 0
je 0x402a50
dec esi
jmp 0x402a39
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4030d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x475020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403170
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403150
xor eax, eax
push ebp
push 0x403149
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40318c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403150
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x475020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x475020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e34
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x477048], 0
je 0x403e95
cmp word [0x47721c], 0xd7b2
jne 0x403e5d
cmp dword [0x477224], 0
jbe 0x403e5d
mov eax, 0x477218
call dword [fcn.00477234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47506c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403ebc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x475030], 0
jne 0x403eb1
push 0
push 0x475064
push 0x47506c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405b38
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405b9e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404220
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c9c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405b88
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ba5
lea eax, [ebp - 0x10]
call fcn.00403fb0
ret

Function at 0x40af6c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40afa5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004040a0
jmp 0x40afae
mov eax, ebx
mov edx, esi
call fcn.00404004
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40afb8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40afd9
mov al, byte [esp]
jmp 0x40afdb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bf78
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c04e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404048
lea eax, [ebp - 8]
call fcn.004044c0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404470
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c038
mov eax, ebx
call fcn.004026d4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c031
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404470
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c01b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c060
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c01b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c038
mov eax, dword [ebp - 0x10]
call fcn.004026f4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c055
lea eax, [ebp - 8]
call fcn.00403fb0
ret
Function at 0x40c5d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c634
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404220
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040812c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c63b
lea eax, [ebp - 0xc]
call fcn.00403fb0
ret

Function at 0x41aabc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x477884
cmp dword [edi], 0
jne 0x41ab38
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x477880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x47546c
mov ecx, 2
call fcn.004028d0
mov edx, 0x41aa94
lea eax, [esi + 5]
call fcn.0041aab4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041aab4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41ab0d
mov dword [0x477880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41c0e4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41c0ea
ret

Function at 0x41e674
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41e6c5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41e6ac
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41e69c
jmp 0x41e6c5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41e6ad
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42cf70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404470
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x42cfc8
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x476434]
mov dl, 1
mov eax, dword [0x42cb28]
call fcn.0040b820
call fcn.004039ec
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042cc30
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43cc58
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x43cba4
call sub.user32.dll_EnumWindows
ret

Function at 0x43cd78
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x43cdf5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0043c7d8
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x43cd9d
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0043c3d8
cmp dword [ebp - 4], 0
je 0x43cddf
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404470
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43cdfc
lea eax, [ebp - 4]
call fcn.00403fb0
ret
Function at 0x4403c8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x477b5c], 0
je 0x440517
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4762a8]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x440517
mov eax, dword [0x477b60]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x477b5c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4404e6
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x477b5c]
call fcn.00413d6c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4404de
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x4404de
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x4404de
mov eax, dword [ebp - 0x14]
call fcn.00449060
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4404de
push ebp
call fcn.00440384
pop ecx
test al, al
jne 0x4404de
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x44049a
mov eax, dword [ebp - 0x14]
call fcn.00447b90
dec eax
jle 0x4404de
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.0040345c
cmp byte [ebp - 1], 0
je 0x4404de
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4404de
mov edx, dword [ebp - 0x14]
mov eax, dword [0x477b60]
call fcn.0043fb50
inc edi
dec ebx
jne 0x44042d
mov eax, dword [0x477b60]
cmp dword [eax + 8], 0
jle 0x4404fe
mov eax, dword [0x477b60]
call fcn.0043fbe0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x440517
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004401ec
pop ecx
test al, al
jne 0x440517
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443af8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x443b44
mov eax, esi
call fcn.0045980c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x443b44
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x443b44
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x443c83
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x443b84
cmp eax, 0x108
ja 0x443b84
mov eax, esi
call fcn.0045980c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x443c7a
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x443c83
jmp 0x443c7a
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x443c63
cmp eax, 0x20a
ja 0x443c63
test byte [esi + 0x50], 0x80
jne 0x443bb6
sub eax, 0x203
je 0x443bb3
sub eax, 3
je 0x443bb3
sub eax, 3
jne 0x443bb6
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x443bca
dec eax
je 0x443bdf
dec eax
je 0x443bfc
dec eax
je 0x443bdf
jmp 0x443c03
mov ecx, ebx
mov eax, dword [0x4762a8]
mov eax, dword [eax]
mov edx, esi
call fcn.00463048
jmp 0x443c7a
cmp byte [esi + 0x5d], 1
jne 0x443bf5
mov eax, esi
mov si, 0xffed
call fcn.0040345c
jmp 0x443c83
or word [esi + 0x54], 1
jmp 0x443c7a
and word [esi + 0x54], 0xfffe
jmp 0x443c7a
mov eax, dword [0x477b18]
cmp byte [eax + 0x20], 0
je 0x443c7a
mov eax, dword [0x477b18]
cmp dword [eax + 0x1c], 0
je 0x443c7a
mov eax, dword [ebx]
mov edx, dword [0x477b18]
cmp eax, dword [edx + 0x1c]
jne 0x443c7a
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00459750
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.0040345c
jmp 0x443c83
cmp eax, 0xb00b
jne 0x443c7a
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.00442418
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret