joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6258a8
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
xor ecx, ecx
mov dword [ebp - 0x278], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 8]
call fcn.00403e28
lea eax, [ebp - 0x274]
mov edx, dword [0x656638]
call fcn.00403e48
xor eax, eax
push ebp
push 0x625a28
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00625074
lea eax, [ebp - 8]
call fcn.00625074
lea eax, [ebp - 0x278]
mov ecx, 0x625a38
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x274]
mov edx, 0x3f
call fcn.006585c8
jmp 0x6259d5
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 4]
call fcn.00403b24
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 8]
call fcn.00403b24
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x44]
inc eax
je 0x6259ca
test byte [ebp - 0x270], 0x10
je 0x62598b
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CreateDirectoryW
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.006258a8
pop ecx
jmp 0x6259ca
mov eax, dword [ebp + 8]
cmp byte [eax - 6], 0
jne 0x6259a0
mov eax, dword [ebp - 0x10]
call fcn.006584d0
test al, al
jne 0x6259ca
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x6259ca
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.006236a4
cmp ax, 2
jne 0x6259a0
mov eax, dword [ebp + 8]
mov byte [eax - 5], 0
lea eax, [ebp - 0x274]
call fcn.0065866c
test eax, eax
jne 0x6259e6
mov eax, dword [ebp + 8]
cmp byte [eax - 5], 0
jne 0x625932
lea eax, [ebp - 0x274]
call fcn.00658690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625a2f
lea eax, [ebp - 0x278]
call fcn.00403880
lea eax, [ebp - 0x274]
mov edx, dword [0x656638]
call fcn.00403f10
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403898
ret
Function at 0x625a40
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor edx, edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 0x26c]
mov edx, dword [0x656638]
call fcn.00403e48
xor eax, eax
push ebp
push 0x625b50
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00625074
lea eax, [ebp - 0x270]
mov ecx, 0x625b60
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x3f
call fcn.006585c8
test eax, eax
jne 0x625b0e
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
inc eax
je 0x625aff
test byte [ebp - 0x268], 0x10
je 0x625af6
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00625a40
pop ecx
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_RemoveDirectoryW
jmp 0x625aff
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x26c]
call fcn.0065866c
test eax, eax
je 0x625ab3
lea eax, [ebp - 0x26c]
call fcn.00658690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625b57
lea eax, [ebp - 0x270]
call fcn.00403880
lea eax, [ebp - 0x26c]
mov edx, dword [0x656638]
call fcn.00403f10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x629804
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
mov word [ebp - 2], dx
push ecx
push edx
call sub.user32.dll_VkKeyScanExW
mov ebx, eax
movzx esi, bx
cmp esi, 0xffff
je 0x629885
lea eax, [ebp - 0x104]
mov edx, pe_nt_image_headers32
call fcn.0065c4dc
mov eax, esi
shr eax, 8
test al, 1
je 0x629848
mov byte [ebp - 0xf4], 0xff
mov edi, dword [ebp + 8]
push edi
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push esi
call sub.user32.dll_ToAsciiEx
mov ebx, eax
test bx, bx
jbe 0x629885
push 1
lea eax, [ebp - 2]
push eax
movzx eax, bx
push eax
lea eax, [ebp - 4]
push eax
push 1
mov eax, edi
call fcn.00656db4
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
mov ax, word [ebp - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x62989c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x629a62
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00650ca0
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov edi, 1
cmp edi, 0x7f
je 0x629962
xor eax, eax
mov dword [ebp - 0xc], eax
inc dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
shl esi, 0xa
add esi, edi
push 0
push 0
push 2
push esi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403de4
test ebx, ebx
jle 0x629914
push ebx
mov eax, dword [ebp - 8]
push eax
push 2
push esi
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 8]
call fcn.006580fc
cmp dword [ebp - 8], 0
je 0x62992c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, esi
mov edx, dword [ebp - 8]
call fcn.00652c78
jmp 0x6298d8
cmp esi, 0x476
jne 0x629958
lea edx, [ebp - 0x10]
mov eax, dword [0x672ae4]
mov eax, dword [eax]
call fcn.00658380
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, 0x476
call fcn.00652c78
jmp 0x629962
cmp dword [ebp - 0xc], 1
jle 0x6298d8
inc edi
cmp edi, 0x93
jne 0x6298ca
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00654594
call fcn.0048e078
call fcn.0048f240
mov esi, eax
call fcn.00651d9c
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov edx, 0x629a78
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 4]
push 8
push 0xffffffffffffffff
xor ecx, ecx
mov edx, 0x629a8c
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
test eax, eax
jge 0x629a05
mov edx, dword [0x6733cc]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.00629cdc
call fcn.00532af4
mov esi, eax
mov eax, dword [esi + 8]
mov ebx, dword [eax + 0x18]
dec ebx
cmp ebx, 0
jl 0x629a3c
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
cmp byte [edi + 0x14], 0
jne 0x6299ec
mov eax, edi
call fcn.00525850
cmp byte [edi + 0x14], 0
je 0x6299fd
mov edx, dword [edi + 0x18]
mov eax, dword [ebp - 4]
call fcn.00629cdc
dec ebx
cmp ebx, 0xffffffff
jne 0x6299d6
jmp 0x629a3c
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x629a3c
lea eax, [ebp - 0x14]
mov edx, ebx
add dl, 0x41
call fcn.00403418
mov edx, dword [ebp - 0x14]
mov ecx, dword [0x6733cc]
mov ecx, dword [ecx]
mov eax, esi
call fcn.0061adb8
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00629cdc
dec ebx
cmp ebx, 0xffffffff
jne 0x629a0d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x629a69
lea eax, [ebp - 0x14]
call fcn.00403274
lea eax, [ebp - 0x10]
call fcn.00403880
lea eax, [ebp - 8]
call fcn.00403880
ret

Function at 0x62a1e4
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
xor edx, edx
mov dword [esp + 4], edx
mov byte [esp], al
mov eax, esp
push eax
push 0x62a18c
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret
Function at 0x63695c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
lea edi, [ebp - 0x14]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov esi, eax
xor eax, eax
push ebp
push 0x636b7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0063d178
mov ebx, eax
mov al, byte [0x636b8c]
cmp al, bl
je 0x6369ac
cmp word [ebp - 0x10], 0xc
jne 0x6369ac
mov word [ebp - 0x10], 0x65
cmp byte [esi + 0x138], 0
jne 0x636b40
mov ax, word [ebp - 0x10]
add eax, 0xfffffff0
sub ax, 3
jae 0x636a26
cmp dword [esi + 0x13c], 0
je 0x6369d7
xor eax, eax
mov dword [esi + 0x13c], eax
lea edx, [ebp - 0x118]
mov eax, ebx
call fcn.006367e4
mov edx, dword [ebp - 0x118]
mov eax, esi
call fcn.006431c4
lea edx, [ebp - 0x118]
mov eax, esi
call fcn.00643138
mov eax, dword [ebp - 0x118]
call fcn.0040351c
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x84]
xor edx, edx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x80]
jmp 0x636b63
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
push 0
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
movzx eax, word [ebp - 0x10]
push eax
call sub.user32.dll_ToAscii
mov edi, eax
dec edi
jne 0x636a73
cmp byte [ebp - 1], 0x20
jb 0x636a73
test bl, 2
jne 0x636a73
cmp word [ebp - 0x10], 0x20
jne 0x636b63
mov al, byte [0x636b90]
cmp al, bl
jne 0x636b63
mov byte [esi + 0x13c], bl
mov al, byte [ebp - 0x10]
mov byte [esi + 0x13d], al
mov byte [esi + 0x13e], 0
call fcn.00466dc0
mov edx, dword [esi + 0x13c]
call fcn.004678e0
test al, al
je 0x636b31
cmp byte [esi + 0x140], 0
je 0x636b1a
mov edx, dword [esi + 0x13c]
mov eax, esi
call fcn.00636884
lea edx, [ebp - 0x118]
mov eax, esi
call fcn.00643138
lea eax, [ebp - 0x118]
mov edx, 0x636b9c
call fcn.00403524
mov edx, dword [ebp - 0x118]
mov eax, esi
call fcn.006431c4
mov byte [esi + 0x138], 1
lea edx, [ebp - 0x118]
mov eax, esi
call fcn.00643138
mov eax, dword [ebp - 0x118]
call fcn.0040351c
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x84]
xor edx, edx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x80]
jmp 0x636b63
xor eax, eax
mov dword [esi + 0x13c], eax
mov edx, dword [esi + 0x13c]
mov eax, esi
call fcn.00636884
jmp 0x636b63
mov edx, dword [esi + 0x13c]
mov eax, esi
call fcn.00636884
jmp 0x636b63
mov ax, word [ebp - 0x10]
add eax, 0xfffffff0
sub ax, 3
jb 0x636b63
mov al, byte [ebp - 0x10]
mov byte [esi + 0x13e], al
mov edx, dword [esi + 0x13c]
mov eax, esi
call fcn.00636884
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x636b83
lea eax, [ebp - 0x118]
call fcn.00403274
ret
Function at 0x639e30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x63a0c7
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [edx + 6]
cmp eax, 0xa
ja case.0x639e54.0
jmp dword [eax*4 + 0x639e5b]
mov eax, esi
mov bx, 0xfff9
call fcn.00403254
jmp case.0x639e54.0
mov eax, esi
mov bx, 0xffe9
call fcn.00403254
jmp case.0x639e54.0
mov byte [esi + 0x135], 0
mov eax, esi
mov bx, 0xffe8
call fcn.00403254
mov eax, dword [esi + 0x120]
mov edx, dword [eax]
call dword [edx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x130]
cmp ebx, eax
jle 0x639ed2
mov ebx, eax
cmp ebx, 1
jge 0x639edc
mov ebx, 1
mov eax, dword [0x672a00]
cmp byte [eax], 0
je 0x639efd
push 0
push ebx
push 0x1701
mov eax, esi
call fcn.00646ed0
push eax
call sub.user32.dll_SendMessageW
jmp 0x639f42
push 0x9e
mov eax, esi
call fcn.006397d8
imul ebx
add eax, dword [esi + 0x34]
add eax, 2
push eax
mov eax, dword [esi + 0x30]
push eax
push 0
push 0
push 0
mov eax, esi
call fcn.00646ed0
push eax
call sub.user32.dll_SetWindowPos
push 0x5f
push 0
push 0
push 0
push 0
push 0
mov eax, esi
call fcn.00646ed0
push eax
call sub.user32.dll_SetWindowPos
cmp byte [esi + 0x135], 0
je 0x639f7d
push 0
push 0
push 0x1f
mov eax, esi
call fcn.00646ed0
push eax
call sub.user32.dll_PostMessageW
cmp byte [esi + 0x134], 0
jne 0x639f7d
push 0
push 0
push 0x14f
mov eax, esi
call fcn.00646ed0
push eax
call sub.user32.dll_PostMessageW
mov byte [esi + 0x136], 0
jmp case.0x639e54.0
cmp byte [0x679ccc], 0
jne case.0x639e54.0
mov eax, esi
call fcn.00639684
test eax, eax
jl case.0x639e54.0
lea edx, [ebp - 4]
mov eax, esi
call fcn.006395c0
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.006431c4
mov eax, esi
mov bx, 0xfffa
call fcn.00403254
mov eax, esi
mov bx, 0xffe9
call fcn.00403254
jmp case.0x639e54.0
mov eax, esi
call fcn.0063963c
test al, al
je case.0x639e54.0
push 0x28
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x63a02f
push 0x26
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x63a02f
push 0x24
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x63a02f
push 0x23
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x63a02f
push 0x21
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x63a02f
push 0x22
call sub.user32.dll_GetKeyState
test ax, ax
jge case.0x639e54.0
mov byte [esi + 0x136], 1
mov eax, esi
call fcn.00639684
mov dword [esi + 0x13c], eax
jmp case.0x639e54.0
cmp byte [esi + 0x136], 0
je case.0x639e54.0
mov eax, esi
call fcn.0063963c
test al, al
je case.0x639e54.0
mov byte [esi + 0x136], 0
mov byte [0x679ccc], 1
mov edx, dword [esi + 0x13c]
mov eax, esi
call fcn.006396a0
mov eax, esi
mov bx, 0xfffa
call fcn.00403254
mov eax, esi
mov bx, 0xffe9
call fcn.00403254
mov byte [0x679ccc], 0
jmp case.0x639e54.0
mov byte [esi + 0x134], 1
invalid
invalid
invalid
invalid
Function at 0x63cf78
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x679cf8
cmp dword [edi], 0
jne 0x63cff4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x679cf4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x670e40
mov ecx, 2
call fcn.004023c8
mov edx, 0x63cf50
lea eax, [esi + 5]
call fcn.0063cf70
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0063cf70
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x63cfc9
mov dword [0x679cf4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x63d124
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x63d174]
test si, 4
je 0x63d138
or bl, 1
test si, 8
je 0x63d142
or bl, 4
test si, 1
je 0x63d14c
or bl, 8
test si, 2
je 0x63d156
or bl, 0x10
test si, 0x10
je 0x63d160
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x63d16f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x63d178
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x63d1b0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x63d191
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x63d1a0
or bl, 4
test esi, 0x20000000
je 0x63d1ab
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x640268
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x150]
test eax, eax
je 0x6402f3
cmp dword [ebx + 0x28], 0
jne 0x6402f0
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x6401e0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x24]
cmp dword [eax + 0x18], 0
je 0x6402f0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x6402c0
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x24]
mov esi, dword [eax + 0x18]
dec esi
cmp esi, 0
jl 0x6402f0
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*4]
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x6402cc
inc dword [ebx + 0x28]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x640eb8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x20], 0
je 0x640ef7
mov eax, dword [ebx + 0x20]
call fcn.00647018
test al, al
je 0x640eef
mov eax, dword [ebx + 0x20]
call fcn.00646ed0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x640eef
push 0
mov eax, dword [ebx + 0x20]
call fcn.00646ed0
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x20]
xor edx, edx
mov dword [eax + 0x18], edx
pop ebx
ret
Function at 0x647e10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor ecx, ecx
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x647f1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403274
mov eax, dword [0x679d54]
push eax
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyExA
shl eax, 0x10
test eax, eax
je 0x647eb4
push 0xff
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
cmp word [ebp - 0x200], 0
jne 0x647e83
cmp word [ebp - 0x202], 0
jne 0x647e8f
cmp byte [ebp - 2], 0x60
jb 0x647e8f
cmp byte [ebp - 2], 0x6f
jbe 0x647ef7
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00403a18
mov eax, dword [ebp - 0x208]
mov edx, ebx
call fcn.00658264
jmp 0x647ef7
cmp byte [ebp - 2], 0
je 0x647ef7
mov eax, dword [0x679d54]
and eax, 0xffff
call fcn.00656db4
push eax
lea eax, [ebp - 0x20c]
mov dl, byte [ebp - 2]
call fcn.00403418
mov eax, dword [ebp - 0x20c]
lea ecx, [ebp - 0x208]
pop edx
call fcn.00658188
mov eax, dword [ebp - 0x208]
mov edx, ebx
call fcn.00658264
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x647f22
lea eax, [ebp - 0x20c]
call fcn.00403274
lea eax, [ebp - 0x208]
call fcn.00403880
ret

Function at 0x64aa84
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x64aa8a
ret

Function at 0x656198
Capabilities:
Suspend thread

Disassembly:
mov byte [eax + 0x21], 1
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
ret

Function at 0x6561a8
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
dec eax
jne 0x6561bb
mov byte [ebx + 0x21], 0
pop ebx
ret

Function at 0x656db4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x656e3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
shr eax, 0xa
jne 0x656dd9
add ebx, 0x400
push 0
push 0
push 0x1004
mov edi, ebx
and edi, 0xffff
push edi
call sub.kernel32.dll_GetLocaleInfoA
mov esi, eax
test esi, esi
jle 0x656e21
lea eax, [ebp - 4]
mov edx, esi
call fcn.00403804
push esi
mov eax, dword [ebp - 4]
push eax
push 0x1004
push edi
call sub.kernel32.dll_GetLocaleInfoA
mov edx, 0x4e4
mov eax, dword [ebp - 4]
call fcn.0065934c
mov ebx, eax
jmp 0x656e26
mov ebx, 0x4e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x656e43
lea eax, [ebp - 4]
call fcn.00403274
ret

Function at 0x659fdc
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, ecx
push pe_nt_image_headers32
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x65a006
mov ecx, eax
dec ecx
mov edx, esp
mov eax, ebx
call fcn.00403964
add esp, 0x200
pop ebx
ret
Function at 0x65a010
Capabilities:
Get geographical location

Disassembly:
push ecx
push 2
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
mov al, byte [esp]
pop edx
ret
Function at 0x4ad0a558
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
and dword [esi], 0
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push 0x4ad0bd88
push 0x80000001
call dword [0x4ad1e040]
test eax, eax
je 0x4ad12194
pop esi
leave
ret 4
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push 0x4ad15b48
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [0x4ad1e02c]
push dword [ebp + 8]
call dword [0x4ad1e028]
jmp 0x4ad0a587
Function at 0x4ad16983
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
cmp dword [ebp + 0xc], 0
push esi
push edi
jne 0x4ad16a2a
xor edi, edi
push 0x104
lea eax, [ebp - 0x208]
push eax
push edi
push dword [ebp + 8]
call dword [0x4ad1e01c]
mov esi, eax
test esi, esi
jne 0x4ad16a19
cmp word [ebp - 0x208], 0x2e
jne 0x4ad16a09
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
mov dword [ebp + 0xc], 0x208
call dword [0x4ad1e018]
mov esi, eax
test esi, esi
jne 0x4ad16a8e
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
push 0x4ad3a340
call fcn.4ad03e14
add esp, 0xc
mov esi, eax
cmp dword [0x4ad289e8], 0
jne 0x4ad16a25
inc edi
test esi, esi
je 0x4ad1699a
jmp 0x4ad16a8e
cmp esi, 0x103
jne 0x4ad16a8e
xor esi, esi
jmp 0x4ad16a8e
xor eax, eax
inc eax
jmp 0x4ad16a90
push 0
push dword [ebp + 0xc]
call fcn.4ad01b82
mov edi, eax
push 0x20
push edi
call fcn.4ad01b0c
test eax, eax
je 0x4ad16a46
and word [eax], 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x410]
push eax
push edi
push dword [ebp + 8]
mov dword [ebp + 0xc], 0x208
call dword [0x4ad1e018]
mov esi, eax
test esi, esi
jne 0x4ad16a7e
lea eax, [ebp - 0x410]
push eax
push edi
push 0x4ad3a340
call fcn.4ad03e14
mov esi, eax
jmp 0x4ad16a8b
push edi
push 1
push 0x23a3
call fcn.4ad0b54d
add esp, 0xc
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x4ad16a96
Capabilities:
Delete registry key
Set registry value

Disassembly:
push 0xc
push 0x4ad1c320
call fcn.4ad01ad3
mov esi, dword [ebp + 0x10]
xor edi, edi
cmp esi, edi
je 0x4ad16b18
cmp word [esi], di
je 0x4ad16b18
push esi
call dword [fcn.4ad01118]
pop ecx
push eax
push esi
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x4ad1e024]
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x4ad16b0c
mov dword [ebp - 4], edi
push edi
push edi
push edi
push 0x8000000
call dword [0x4ad1e05c]
push esi
push dword [ebp + 0xc]
push 0x4ad3a340
call fcn.4ad03e14
add esp, 0xc
or dword [ebp - 4], 0xffffffff
jmp 0x4ad16b3d
push dword [ebp + 0xc]
push 1
push 0x235d
jmp 0x4ad16b35
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x4ad1e020]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x4ad16b3d
push dword [ebp + 0xc]
push 1
push 0x23a3
call fcn.4ad0b54d
add esp, 0xc
mov eax, dword [ebp - 0x1c]
call fcn.4ad01371
ret 0xc