joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465e78
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x408340]
call fcn.00405e58
xor eax, eax
push ebp
push 0x466019
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a67f8], 0
jne 0x465ed3
mov ecx, dword [0x52c2bc]
mov dl, 1
mov eax, dword [0x40896c]
call fcn.0040d61c
call fcn.00404bfc
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403990
mov eax, ebx
call fcn.00405c10
mov dword [ebp - 0x24], eax
mov esi, 0x466028
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406e00
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405c20
test eax, eax
jle 0x465fbc
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x465fa8
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004054f8
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x465f4e
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405510
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x465f64
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405510
mov eax, dword [ebp - 0x54]
call fcn.00405718
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004054f8
mov eax, dword [ebp - 0x58]
call fcn.00405718
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x465faa
xor eax, eax
test al, al
je 0x465fb5
mov ebx, 0x15
jmp 0x465fc1
mov ebx, 0x10
jmp 0x465fc1
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4a67f8]
call fcn.00465cf8
mov eax, dword [ebp - 4]
call fcn.00465cf8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406e18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466020
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.004052ac
lea eax, [ebp - 0xc]
mov edx, dword [0x408340]
call fcn.00405f28
ret
Function at 0x474210
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4742ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405a90
mov eax, dword [0x52c334]
cmp byte [eax], 0
je 0x47427f
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405df4
mov eax, dword [ebx]
call fcn.00405c20
push eax
mov eax, dword [ebx]
call fcn.00405c10
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405c20
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405df4
jmp 0x4742b1
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040a640
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405c00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4742d1
lea eax, [ebp - 0x3f0]
call fcn.00405288
ret

Function at 0x4742d8
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.0040a640
add esp, 0x3ec
pop ebx
ret

Function at 0x474498
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov esi, edx
mov ebp, eax
mov edx, esi
mov eax, dword [ebp + 0x3c]
call dword [ebp + 0x38]
cmp dword [esi + 0xc], 0
jne 0x474560
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.00459014
mov ebx, eax
movzx edx, word [esi + 4]
mov eax, ebp
call fcn.00474154
mov edi, eax
test edi, edi
je 0x4744f9
movzx eax, byte [0x47456c]
cmp al, bl
jne 0x4744f9
mov edx, edi
mov eax, ebp
call fcn.0047408c
mov dword [esi + 0xc], 1
mov byte [ebp + 0x31], 1
jmp 0x474560
cmp byte [ebp + 0x161], 2
jne 0x474524
mov eax, dword [esi + 8]
push eax
movzx ecx, word [esi + 4]
mov eax, dword [0x52c6e0]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
mov edx, 0xb006
call fcn.00447254
test eax, eax
jne 0x474560
jmp 0x47455b
mov edx, dword [0x52c5d4]
mov edx, dword [edx]
mov edx, dword [edx + 0x44]
mov eax, dword [ebp + 0x128]
cmp edx, eax
je 0x47455b
test byte [eax + 0x358], 8
jne 0x47455b
mov eax, dword [esi + 8]
push eax
movzx ecx, word [esi + 4]
mov eax, dword [0x52c5d4]
mov eax, edx
mov edx, 0xb006
call fcn.00447254
xor eax, eax
mov dword [esi + 0xc], eax
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47a880
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [0x52c6e0]
mov eax, dword [eax]
cmp dword [eax + 0x58], 0
jne 0x47a926
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x80]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x84]
cdq
cmp edx, dword [esp + 4]
jne 0x47a8c5
cmp eax, dword [esp]
pop edx
pop eax
jae 0x47a901
jmp 0x47a8c9
pop edx
pop eax
jge 0x47a901
mov eax, dword [0x52c6e0]
mov eax, dword [eax]
mov dword [eax + 0x38], 2
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0047529c
mov eax, dword [ebx + 0xf4]
test eax, eax
je 0x47a926
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x47a926
cmp dword [ebx + 0x11c], 0
je 0x47a926
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.00435b04
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x12c]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4817e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x48189a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405a90
mov eax, dword [0x52c334]
cmp byte [eax], 0
je 0x48184f
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405df4
mov eax, dword [ebx]
call fcn.00405c20
push eax
mov eax, dword [ebx]
call fcn.00405c10
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405c20
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405df4
jmp 0x481881
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040a640
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405c00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4818a1
lea eax, [ebp - 0x3f0]
call fcn.00405288
ret

Function at 0x484a08
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x484a62
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x310], ecx
mov dword [esi + 0x314], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x304], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x310]
mov eax, esi
call fcn.00484a6c
mov eax, dword [esi + 0x310]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x6c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484a69
ret
Function at 0x48b2c0
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_IsWindow
test eax, eax
jne 0x48b2f6
jmp 0x48b39c
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov eax, esp
push eax
push 0
push 0x419
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
test esi, 2
jbe 0x48b33a
mov edx, dword [ebx + 0x4c]
cmp dword [edx + 0x184], 0
je 0x48b33a
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 0x184]
mov eax, dword [eax + 0x14]
jmp 0x48b34a
mov edx, dword [ebx + 0x4c]
mov edx, dword [edx + 0x180]
test edx, edx
je 0x48b34a
mov eax, dword [edx + 0x14]
test eax, eax
je 0x48b363
push eax
push 2
push 5
mov edx, dword [edi + 0x10]
lea ecx, [esp + 0xc]
mov eax, ebx
call fcn.00487c4c
jmp 0x48b39c
mov dl, 1
mov eax, dword [0x423f70]
call fcn.0042618c
mov esi, eax
mov edx, dword [edi + 0x10]
mov eax, esi
call fcn.00426b60
mov eax, dword [ebx + 0x4c]
mov edx, dword [eax + 0xc4]
mov eax, dword [esi + 0x10]
call fcn.00425cb0
mov edx, esp
mov eax, esi
call fcn.0042689c
mov eax, esi
call fcn.00404388
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x48dbcc
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.0044df34
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x2c1], 0
xor edx, edx
mov eax, ebx
call fcn.00445e90
pop ebx
ret
Function at 0x498244
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x98], 0
je 0x49826a
push 0
mov eax, dword [ebx + 0x94]
call fcn.0044df34
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x98], 0
pop ebx
ret

Function at 0x498324
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x498496
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xa4], 1
mov eax, dword [ebp - 0xc]
test byte [eax + 0x1c], 0x10
jne 0x49847b
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x10d]
call fcn.0040a640
mov dl, 1
mov eax, dword [0x46e6c4]
call fcn.0046e71c
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x9c], eax
mov dl, 1
mov eax, dword [0x417c20]
call fcn.00404358
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x9c]
call fcn.0046e798
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x498477
mov dl, 1
mov eax, dword [0x46fc30]
call fcn.0046fc98
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x34], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x9c]
mov edx, 0x4984ac
call fcn.0046ef0c
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004055a0
xor eax, eax
push ebp
push 0x498470
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x34]
call fcn.0046ffa0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.004984b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498477
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x9c]
call fcn.00404388
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.00404388
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x34]
call fcn.00404388
ret
movzx ebx, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49849d
lea eax, [ebp - 8]
mov edx, 2
call fcn.004052ac
ret
Function at 0x49bd88
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov eax, dword [esi + 0x44]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
mov eax, dword [esi + 0x70]
push eax
call sub.kernel32.dll_PostQueuedCompletionStatus
mov eax, dword [esi + 0x70]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0x42000000
push 3
push 0
push 7
push 0xc0000000
mov eax, dword [esi + 0x68]
call fcn.00405718
push eax
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
mov eax, esi
call fcn.0049bd7c
mov dword [esi + 0x44], edi
mov eax, esi
call fcn.0049bf10
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x49bdf7
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
jne 0x49be11
mov eax, esi
call fcn.0049bd7c
xor eax, eax
mov dword [esi + 0x44], eax
xor eax, eax
mov dword [esi + 0x70], eax
mov eax, esi
call fcn.0049bf10
jmp 0x49be86
push 0
mov eax, dword [esi + 4]
push eax
push 0
mov eax, dword [esi + 0x44]
push eax
call sub.kernel32.dll_CreateIoCompletionPort
mov ebx, eax
mov eax, esi
call fcn.0049bd7c
mov dword [esi + 0x70], ebx
mov eax, esi
call fcn.0049bf10
xor eax, eax
mov dword [esi + 0x8c], eax
lea eax, [esi + 0x90]
xor ecx, ecx
mov edx, 0x1000
call fcn.00403990
push 0
lea eax, [esi + 0x74]
push eax
lea eax, [esi + 0x8c]
push eax
mov eax, dword [esi + 0x88]
push eax
cmp byte [esi + 0x6c], 1
cmc
sbb eax, eax
push eax
push 0x1000
lea eax, [esi + 0x90]
push eax
mov eax, dword [esi + 0x44]
push eax
call sub.kernel32.dll_ReadDirectoryChangesW
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x49cd18
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403990
ret
Function at 0x49d104
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
xor edx, edx
mov dword [ebp - 0x418], edx
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x49d37b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x49d390
call fcn.0049cf6c
lea eax, [ebp - 0x3f0]
call fcn.00405288
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.00405718
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x49d33c
xor eax, eax
push ebp
push 0x49d335
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x3e9
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x49d3d0
call fcn.0049cf6c
mov eax, dword [ebp - 0x408]
call fcn.00405718
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x49d207
push ebp
mov eax, 0x49d3fc
call fcn.0049d05c
pop ecx
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x40c]
mov eax, 0x49d408
call fcn.0049cf6c
mov eax, dword [ebp - 0x40c]
call fcn.00405718
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x49d291
push dword [ebp - 0x3f0]
push 0x49d430
lea eax, [ebp - 0x410]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.004054f8
push dword [ebp - 0x410]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.0040561c
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x414]
mov eax, 0x49d43c
call fcn.0049cf6c
mov eax, dword [ebp - 0x414]
call fcn.00405718
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x49d31b
push dword [ebp - 0x3f0]
push 0x49d430
lea eax, [ebp - 0x418]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.004054f8
push dword [ebp - 0x418]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.0040561c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d33c
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.004052dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d382
lea eax, [ebp - 0x418]
mov edx, 5
call fcn.004052ac
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.004052ac
ret
Function at 0x49e9e8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405708
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x49eb50
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0049c3f8
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.0049c418
mov ebx, eax
jmp 0x49eb22
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004054f8
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a1e4
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409618
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409618
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004056b0
je 0x49eb02
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004054f8
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409618
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409618
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004056b0
jne 0x49eb17
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.0049c438
mov ebx, eax
test ebx, ebx
jne 0x49ea63
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49eb57
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004052ac
lea eax, [ebp - 4]
call fcn.00405288
ret
Function at 0x49eecb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x49ef25
mov eax, ebx
add eax, dword [eax + 0x3c]
mov edi, dword [eax + 0x78]
add edi, ebx
xor esi, esi
jmp 0x49ef20
mov eax, dword [edi + 0x20]
lea edx, [ebx + eax]
mov eax, dword [edx + esi*4]
add eax, ebx
push dword [ebp + 0xc]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x49ef1f
mov edx, dword [edi + 0x24]
lea ecx, [ebx + edx]
mov ax, word [ecx + esi*2]
movzx edx, ax
mov ecx, dword [edi + 0x1c]
lea eax, [ebx + ecx]
mov eax, dword [eax + edx*4]
add eax, ebx
mov dword [ebp - 4], eax
inc esi
cmp esi, dword [edi + 0x18]
jb 0x49eeec
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4a01e4
Capabilities:
Log keystrokes via application hook

Disassembly:
xor eax, eax
mov dword [0x531f98], eax
push 0x4a0224
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x531f98], eax
mov eax, dword [0x52c5d4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [0x531f9c], eax
push 0
mov eax, dword [0x52f7f8]
push eax
push 0x4a019c
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [0x531fa0], eax
ret

Function at 0x4a044c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405708
xor eax, eax
push ebp
push 0x4a0526
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4a053c
mov edx, dword [ebp - 4]
call fcn.004055a0
mov eax, dword [ebp - 8]
call fcn.00405718
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4a0496.0
jmp dword [eax*4 + 0x4a049d]
mov eax, ebx
mov edx, 0x4a0548
call fcn.004052dc
jmp 0x4a050b
mov eax, ebx
mov edx, 0x4a055c
call fcn.004052dc
jmp 0x4a050b
mov eax, ebx
mov edx, 0x4a056c
call fcn.004052dc
jmp 0x4a050b
mov eax, ebx
mov edx, 0x4a0580
call fcn.004052dc
jmp 0x4a050b
mov eax, ebx
mov edx, 0x4a0590
call fcn.004052dc
jmp 0x4a050b
mov eax, ebx
mov edx, 0x4a05a4
call fcn.004052dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a052d
lea eax, [ebp - 8]
mov edx, 2
call fcn.004052ac
ret
Function at 0x402a6c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404090
test esi, esi
jne 0x402aa2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404180
jmp 0x402ac0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402980
mov edi, eax
test esi, esi
je 0x402ac0
cmp dword [ebx], 0
je 0x402ac0
dec esi
jmp 0x402aa9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402d38
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x489008], 0x8088405
inc edx
mov dword [ebx + 0x489008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x489024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403228
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403208
xor eax, eax
push ebp
push 0x403201
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403244
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403208
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x489024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x489024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403ef4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48b04c], 0
je 0x403f55
cmp word [0x48b220], 0xd7b2
jne 0x403f1d
cmp dword [0x48b228], 0
jbe 0x403f1d
mov eax, 0x48b21c
call dword [0x48b238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x489070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403f7c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x489034], 0
jne 0x403f71
push 0
push 0x489068
push 0x489070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret