joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d47f4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403bd0
ret

Function at 0x4d4be0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
xor edx, edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4d4d25
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x4d4d38
call fcn.004d4a48
lea eax, [ebp - 0x3f0]
call fcn.004054f8
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.004059a4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4d4ceb
xor edx, edx
push ebp
push 0x4d4ce4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x3e9
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x4d4d78
call fcn.004d4a48
mov eax, dword [ebp - 0x408]
call fcn.004059a4
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d4cca
push ebp
mov eax, 0x4d4da4
call fcn.004d4b38
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4ceb
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.0040554c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4d2c
lea eax, [ebp - 0x408]
call fcn.004054f8
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.0040551c
ret
Function at 0x4d4f40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
xor edx, edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4d5104
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x4d5118
call fcn.004d4da8
lea eax, [ebp - 0x3f0]
call fcn.004054f8
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.004059a4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4d50c5
xor eax, eax
push ebp
push 0x4d50be
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x3e9
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
push 0x4d5150
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d501a
push ebp
mov eax, 0x4d516c
call fcn.004d4e98
pop ecx
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x4d5178
call fcn.004d4da8
mov eax, dword [ebp - 0x408]
call fcn.004059a4
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d50a4
push dword [ebp - 0x3f0]
push 0x4d519c
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.00405768
push dword [ebp - 0x40c]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.004058a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d50c5
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.0040554c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d510b
lea eax, [ebp - 0x40c]
mov edx, 2
call fcn.0040551c
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.0040551c
ret
Function at 0x4dab2c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4dac67
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4dac37
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004059a4
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040ae94
test al, al
jne 0x4daba7
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.0040392c
lea eax, [ebp - 0x1d0]
call fcn.004036c8
call fcn.004030f4
push dword [0x4f4dcc]
push 0x4dac80
push dword [0x4f4dd0]
push 0x4dac80
push dword [0x4f4dd4]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.004058a8
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.004e1980
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405cc4
call fcn.00404024
call fcn.004030f4
lea eax, [ebp - 0x1d0]
call fcn.004039f4
call fcn.004030f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dac41
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dac6e
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.0040551c
lea eax, [ebp - 4]
call fcn.004054f8
ret
Function at 0x4dbde8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4dbf50
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004dafc0
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004dafe0
mov ebx, eax
jmp 0x4dbf22
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405768
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040b428
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409d7c
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409d7c
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.0040593c
je 0x4dbf02
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405768
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409d7c
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409d7c
mov edx, dword [ebp - 0x148]
pop eax
call fcn.0040593c
jne 0x4dbf17
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004db000
mov ebx, eax
test ebx, ebx
jne 0x4dbe63
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbf57
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040551c
lea eax, [ebp - 4]
call fcn.004054f8
ret

Function at 0x4de2bc
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x17
call sub.user32.dll_GetSystemMetrics
test eax, eax
je 0x4de2d8
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
setne al
ret
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
setne al
ret

Function at 0x4de348
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4de422
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4de438
mov edx, dword [ebp - 4]
call fcn.0040582c
mov eax, dword [ebp - 8]
call fcn.004059a4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4de392.0
jmp dword [eax*4 + 0x4de399]
mov eax, ebx
mov edx, 0x4de444
call fcn.0040554c
jmp 0x4de407
mov eax, ebx
mov edx, 0x4de454
call fcn.0040554c
jmp 0x4de407
mov eax, ebx
mov edx, 0x4de464
call fcn.0040554c
jmp 0x4de407
mov eax, ebx
mov edx, 0x4de478
call fcn.0040554c
jmp 0x4de407
mov eax, ebx
mov edx, 0x4de488
call fcn.0040554c
jmp 0x4de407
mov eax, ebx
mov edx, 0x4de49c
call fcn.0040554c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de429
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040551c
ret
Function at 0x4de8f4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4de989
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4de9a0
mov edx, dword [ebp - 4]
call fcn.0040582c
push 0xff
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xff
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 8]
call fcn.004059a4
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0040a88c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de990
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040551c
ret
Function at 0x4029e4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403f5c
test esi, esi
jne 0x402a1a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040404c
jmp 0x402a38
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004028f8
mov edi, eax
test esi, esi
je 0x402a38
cmp dword [ebx], 0
je 0x402a38
dec esi
jmp 0x402a21
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40309c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x462020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403134
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403114
xor eax, eax
push ebp
push 0x40310d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403150
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403114
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x462020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x462020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403de0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x471048], 0
je 0x403e41
cmp word [0x47121c], 0xd7b2
jne 0x403e09
cmp dword [0x471224], 0
jbe 0x403e09
mov eax, 0x471218
call dword [0x471234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46206c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403e68
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x462030], 0
jne 0x403e5d
push 0
push 0x462064
push 0x46206c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405ab4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405b1a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004041cc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c60
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405b04
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b21
lea eax, [ebp - 0x10]
call fcn.00403f5c
ret

Function at 0x40abf0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ac29
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040404c
jmp 0x40ac32
mov eax, ebx
mov edx, esi
call fcn.00403fb0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ac3c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ac5d
mov al, byte [esp]
jmp 0x40ac5f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b2e4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b15c
mov eax, dword [0x470dd0]
cmp byte [eax], 0
je 0x40b360
mov eax, dword [0x470b48]
call fcn.00402acc
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408428
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b3a8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b396
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x470adc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x471664]
call fcn.00404fc8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40bbfc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bcd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403ff4
lea eax, [ebp - 8]
call fcn.0040446c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040441c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40bcbc
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40bcb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040441c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40bc9f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40bce4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40bc9f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bcbc
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bcd9
lea eax, [ebp - 8]
call fcn.00403f5c
ret

Function at 0x40c1c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c228
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004041cc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407f84
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c22f
lea eax, [ebp - 0xc]
call fcn.00403f5c
ret

Function at 0x41a584
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x471884
cmp dword [edi], 0
jne 0x41a600
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x471880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4623ec
mov ecx, 2
call fcn.004028b8
mov edx, 0x41a55c
lea eax, [esi + 5]
call fcn.0041a57c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a57c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a5d5
mov dword [0x471880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41b81c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41b822
ret
Function at 0x41dd58
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41dda9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41dd90
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41dd80
jmp 0x41dda9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41dd91
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426268
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00425c6c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040441c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4262c6
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x470cc0]
mov dl, 1
mov eax, dword [0x425b64]
call fcn.0040b4a4
call fcn.00403998
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4262d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040441c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x426328
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x470f2c]
mov dl, 1
mov eax, dword [0x425b64]
call fcn.0040b4a4
call fcn.00403998
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00425c9c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42ea2c
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x42e978
call sub.user32.dll_EnumWindows
ret

Function at 0x42eb4c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x42ebc9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0042e5ac
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x42eb71
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0042e1ac
cmp dword [ebp - 4], 0
je 0x42ebb3
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.0040441c
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ebd0
lea eax, [ebp - 4]
call fcn.00403f5c
ret
Function at 0x431d14
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x471b54], 0
je 0x431e63
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x470d58]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x431e63
mov eax, dword [0x471b58]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x471b54]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x431e32
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x471b54]
call fcn.00413968
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x431e2a
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x431e2a
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x431e2a
mov eax, dword [ebp - 0x14]
call fcn.0043a9ac
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x431e2a
push ebp
call fcn.00431cd0
pop ecx
test al, al
jne 0x431e2a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x431de6
mov eax, dword [ebp - 0x14]
call fcn.004394dc
dec eax
jle 0x431e2a
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00403420
cmp byte [ebp - 1], 0
je 0x431e2a
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x431e2a
mov edx, dword [ebp - 0x14]
mov eax, dword [0x471b58]
call fcn.0043149c
inc edi
dec ebx
jne 0x431d79
mov eax, dword [0x471b58]
cmp dword [eax + 8], 0
jle 0x431e4a
mov eax, dword [0x471b58]
call fcn.0043152c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x431e63
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00431b38
pop ecx
test al, al
jne 0x431e63
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret