joyce8/EMBER2024-capa huggingface dataset:
Function at 0x878371
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 2], ecx
jmp 0x878413
shl bx, cl
rol bx, cl
mov edi, dword [esp + 3]
mov ebx, 0xc34de084
xchg byte [esp + 4], al
rdtsc
jmp 0x8783fb
rdtsc
mov eax, 0x6a0ba876
shr ecx, 0x17
lea esp, [esp + 4]
lea esp, [esp + 5]
push dword [esp + 2]
jmp 0x87839f
stc
rcr esi, 5
sub esp, 0x16
xchg edx, esi
xchg bx, di
pushal
jmp 0x878482
add esp, 5
pop bx
mov edx, dword [esp]
inc ax
rol si, cl
mov bl, bh
jmp 0x8783d5
add esp, 1
xchg si, bp
mov ebx, esi
sub esp, 6
xchg ebx, esi
xor dl, ch
jmp 0x8783bd
mov ebx, 0x49e5ffae
xchg cx, bp
mov word [esp], di
lea eax, [ebx + edi]
mov si, di
jmp 0x87849e
mov dword [esp + 0x13], eax
mov bl, 0x40
mov ah, byte [esp + 0x1a]
setnp bh
mov ebx, 0x60f36ad0
mov ch, byte [esp + 0xd]
jmp 0x878424
mov ecx, 0xa4ba28f6
lea edx, [ebx + esi]
lea ebx, [esi*4]
push edx
mov cx, 0xa5c5
sub esp, 0xe
jmp 0x878440
mov ax, word [esp + 0x19]
lea esp, [esp + 0x30]
and eax, ecx
setp dh
push word [esp + 4]
lea ebx, [ebp*4]
jmp 0x878464
pop word [esp + 8]
lea ecx, [edx*4]
rdtsc
xchg dword [esp + 4], ebp
lea ebp, [edx + ebx]
cmc
jmp 0x878bdb
mov dx, word [esp + 2]
lea esp, [esp + 3]
neg ebp
lea eax, [esp + ecx]
mov byte [esp], ah
mov bx, word [esp]
jmp 0x878516
xchg bp, dx
bswap edi
mov edi, ebp
clc
cmc
sub esp, 4
jmp 0x8784c9
xchg si, di
pushal
mov cl, ch
xchg dh, al
xchg cx, ax
sub esp, 0x14
jmp 0x878544
mov eax, 0x2a72b4dc
lea esi, [ebp - 0x265d3ca9]
mov ah, byte [esp]
xchg edi, ebp
not dh
xchg byte [esp], bl
jmp 0x8784f4
pushal
lea esp, [esp + 0x55]
bsf dx, si
mov esi, dword [esp]
call fcn.0087852d
js 0x878552
invalid
imul ecx, dword [esi], 0xfffffffd
sbb byte [esi - 0x57], bl
enter 0xffffffffffff826b, 0x3d
xor esi, esi
btc ecx, edi
mov dl, dh
inc eax
mov dl, dh
mov ecx, 0xbfe2eae8
jmp 0x8784e6
mov dx, sp
mov bl, bh
mov dx, di
add si, 0x51d6
rol bx, cl
xchg ebx, edx
jmp 0x878561
mov dl, dh
btc ecx, edi
mov dl, byte [esp]
mov bl, 0xe0
not eax
setle dh
jmp 0x878706
mov eax, 0xfc36e386
cld
cmc
bswap edi
lea edi, [ebp - 0x37]
xchg ecx, eax
jmp 0x8788b8
push dword [esp + 0x10]
rdtsc
setae dh
xchg byte [esp + 0x22], bl
sub esp, 0xc
lea esp, [esp + 0x49]
jmp 0x878981
bswap eax
xchg ah, bl
mov dx, di
cpuid
inc al
pushal
jmp 0x8789ac
Function at 0x878575
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], bx
cpuid
inc cl
sub esp, 6
jmp 0x878609
cpuid
ror ah, 1
setae bh
lea esp, [esp + 0x17]
pop ecx
pop esi
jmp 0x878696
clc
pop word [esp + 0x13]
mov bp, word [esp + 0xf]
cld
pop ecx
rdtsc
jmp 0x8785b6
pop word [esp + 0x14]
xchg ch, dl
sub esp, 0x18
rdtsc
neg ebp
pop dx
jmp 0x8785d5
bswap ebp
lea esi, [ebp + 0xc7]
rdtsc
lea esp, [esp + 0xf]
not di
mov byte [esp + 0xd], bh
jmp 0x8785ec
mov ebp, dword [esp]
pushal
mov ah, byte [esp + 1]
mov byte [esp + 0x1e], bh
popal
xchg ebx, eax
jmp 0x878670
cpuid
xchg dh, al
shr bh, 3
mov ebx, ebp
rdtsc
pop esi
jmp 0x87867f
add esp, 1
clc
mov al, ah
pop bx
inc dl
shl di, cl
jmp 0x87863b
inc bp
bswap ebp
not ax
push edx
xchg byte [esp], cl
xchg esi, edi
jmp 0x87864b
mov ebp, esi
setae bh
bswap ebp
sub esp, 0x18
rdtsc
mov bx, sp
call fcn.008786e1
push es
mov cl, 0xb0
mov edx, dword [esp + 0x17]
mov cx, di
cld
lea esp, [esp + 0x15]
not ax
ror ch, 5
jmp 0x878661
Function at 0x8786e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
push word [esp + 5]
cmc
stc
setns dh
sub esp, 0xa
jmp 0x8786e3
push dword [esp + 6]
mov bp, word [esp + 2]
pop word [esp + 0xd]
mov bp, 0x8cc5
pop bp
btr ecx, edx
jmp 0x8786aa
jmp 0x8786c4
rdtsc
cld
mov byte [esp + 0x22], dh
mov bl, bh
pop bx
ror ah, 1
jmp 0x87888a
setg dh
cpuid
mov cx, word [esp + 8]
mov ebp, eax
rdtsc
neg ch
jmp 0x8787b4
lea edi, [eax + edi]
xchg byte [esp + 0x10], cl
lea ecx, [esi + 0x5b2ffa15]
mov ah, byte [esp + 0xf]
bswap edx
pop dword [esp + 4]
jmp 0x87871d
pop dword [esp]
xchg bx, ax
mov esi, 0xa2711168
add esp, 0xd
mov dx, 0xe6bf
push dword [esp + 8]
jmp 0x878736
xchg dh, al
neg dx
setno ch
mov word [esp + 0x14], bx
xchg bh, cl
lea eax, [ebx*4]
jmp 0x878756
btc esi, ebx
pop word [esp + 0xa]
mov cl, 0x6a
call fcn.00878798
push word [esp + 0xc]
add esp, 0x13
lea edi, [ebx + ebx]
lea esi, [esi - 0x7d]
xchg dword [esp + 0x10], edi
jmp 0x8787f1
mov dword [esp + 0x15], ecx
mov dx, 0x5ffb
setne dh
pop word [esp + 1]
lea esp, [esp + 9]
push word [esp + 7]
jmp 0x878849
pop dword [esp + 0xb]
mov dword [esp + 5], eax
mov dword [esp + 2], ebp
xchg dword [esp + 8], ebx
bswap ebp
mov dword [esp], ebp
jmp 0x878868
lea eax, [ecx*4]
lea esi, [ebx*4]
lea ebx, [ebp + 0xa7]
not edx
mov bx, sp
mov esi, dword [esp + 0x12]
jmp 0x87882c
mov bh, byte [esp + 9]
clc
cmc
rdtsc
xor dl, ch
cpuid
jmp 0x87889d
cpuid
cmc
mov cl, ch
mov dx, bx
mov bh, byte [esp + 0x17]
pop ax
jmp 0x878780
mov si, sp
mov cl, ch
add esp, 0xe
mov edi, ecx
pop dx
mov edi, eax
jmp 0x878925
mov dl, dh
push esp
lea edi, [esi + 0x25]
add esp, 4
add esp, 0x15
not ecx
jmp 0x878905
mov eax, 0x377f04a8
lea ebp, [edx + edx]
neg bx
neg ebx
btc edx, edi
xchg byte [esp + 0xc], al
setno bh
jmp 0x8788cc
pop dword [esp]
mov esi, 0x47fb06e4
mov esi, dword [esp + 1]
push esp
mov ax, 0x1eb1
pop cx
jmp 0x87895f
bswap ecx
pushal
push word [esp + 0x13]
pop word [esp + 1]
push word [esp + 0xc]
xchg byte [esp + 6], dl
jmp 0x8788ee
lea ecx, [edx*4]
xchg esi, eax
lea esp, [esp + 0xd]
mov cx, 0x442f
bswap eax
mov ax, word [esp + 2]
jmp 0x878993
ja 0x8788f7
cld
iretd
rdtsc
mov dx, di
mov cl, ch
mov cx, bx
neg bx
push esp
jmp 0x87893d
add esp, 1
mov ch, byte [esp + 1]
xchg ebp, esi
mov dl, dh
mov bp, dx
cpuid
jmp 0x878b31
not ax
mov edi, dword [esp]
setp ah
mov bp, sp
setg ah
call fcn.00878a3c
or al, 0x80
push ss
jno 0x87895b
imul edi, dword [ebp + 0x4a0cbf8c], 0xfffffffb
xchg esi, eax
mov edi, 0x96fb4a0c
xchg ch, dl
cld
cld
mov edx, ecx
mov cx, 0x8f17
jmp 0x8789c2
mov edi, ebp
add esp, 0
mov dl, dh
lea ecx, [ecx - 0xc3]
mov dl, dh
cld
jmp 0x8789de
add esp, 0
cpuid
xchg edi, eax
cpuid
mov cx, word [esp]
xchg edi, ebp
jmp 0x8789f8
not ch
lea ebp, [ebp + 0xf]
mov eax, 0xbd1d6088
push esp
pop edx
bsr si, cx
jmp 0x878a0f
and cl, bh
lea esp, [esp + 1]
xchg ah, bl
mov byte [esp], ch
bswap eax
mov ebx, 0xc3c86b30
jmp 0x878a63
stc
btr edx, edx
mov byte [esp], dh
mov ebp, dword [esp]
xchg byte [esp], cl
mov al, 0xee
jmp 0x878aba
Function at 0x878798
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop di
xchg edx, esi
mov edi, ecx
jmp 0x878817
pop word [esp + 0xa]
sub esp, 2
mov si, 0xe1b1
inc ecx
pushal
mov byte [esp + 0x25], ah
jmp 0x8787c3
rcl si, cl
mov dh, byte [esp + 0xb]
btr ebx, esp
xchg bp, dx
mov di, word [esp]
xchg ah, bl
jmp 0x8787dd

Function at 0x878c8f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [esi - 5]
mov edi, dword [esp]
mov eax, 0xe5b9d3de
lea ebx, [edi + edi]
mov eax, dword [esp]
jmp 0x878c75
inc al
xchg cx, ax
mov ax, sp
bsf bx, ax
neg edi
mov al, byte [esp]
jmp 0x878bec
xchg byte [esp + 0xa], cl
xchg dword [esp + 0x18], edi
popal
lea edi, [esi - 0x54e58b6b]
bsf ax, ax
cld
jmp 0x878c04
mov dl, dh
xchg ecx, eax
sub esp, 0xc
lea esp, [esp + 0x46]
pushal
mov byte [esp + 0x17], ah
jmp 0x878c27
lea ecx, [eax*4]
inc ecx
neg bh
mov dl, 0x3c
mov bl, 0xc0
xchg ebx, esi
jmp 0x878cbb
not bp
lea eax, [ebx*4]
btr eax, esp
mov bl, byte [esp]
jmp 0x878c5e
sub esp, 6
pop word [esp + 0xd]
add ax, 0x4f6e
jmp 0x878c4d
lea ecx, [edi*4]
mov edx, 0xf5d3fdec
rdtsc
lea esi, [esp + esi]
mov bp, dx
mov ebx, esi
jmp 0x878d0f
lea esi, [edx*4]
mov edi, dword [esp]
mov ebx, 0xb5f74752
mov si, 0xedaf
mov dx, 0x523
rdtsc
jmp 0x878c9d
inc ecx
mov esi, dword [esp]
rcr ch, 5
not eax
xchg bh, cl
mov ecx, dword [esp]
call fcn.00878cef

Function at 0x878cef
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, word [esp + 2]
mov esi, 0x6d3f98a2
lea ecx, [edx + edi]
lea ebp, [eax + 0x19]
sub esp, 0x1c
jmp 0x878cf1
jmp 0x878cd6
btc ebp, ebx
lea esp, [esp + 9]
neg eax
mov bl, 0xd0
xchg byte [esp + 4], cl
bswap ecx
jmp 0x878d4a
mov dh, byte [esp + 0xf]
bswap edi
bsf cx, si
mov ah, byte [esp]
lea edx, [eax + edi]
pop dword [esp + 5]
jmp 0x878dfe
setle ah
mov bl, 0x60
pop dword [esp + 3]
inc cl
lea esi, [edx + ebx]
mov byte [esp + 0x11], bh
jmp 0x878d22
mov dword [esp + 9], ebp
xchg bp, di
push dword [esp + 4]
rdtsc
not ah
mov cl, 0x62
jmp 0x878dd3
mov edx, 0xf18fda3c
cmc
lea ebx, [esp + edi]
sub esp, 0x10
lea ebp, [eax + edi]
jmp 0x878d72
push word [esp + 6]
inc ebp
cpuid
pushal
lea esp, [esp + 0x4d]
lea edx, [ecx + edx]
jmp 0x878d8e
mov edx, 0x1bad0ce6
xchg dword [esp + 2], ebx
xchg bh, cl
neg bp
btr ebp, edx
bsf bp, ax
jmp 0x878e56
add bp, 0x9cc6
mov bx, word [esp + 4]
xchg dx, ax
pop dword [esp]
inc al
xchg word [esp + 0xb], dx
jmp 0x878db8
mov bl, 0x10
cld
push dword [esp + 0xc]
sub esp, 0x1c
pop dword [esp + 2]
btr esi, edx
jmp 0x878da6
xchg byte [esp + 1], cl
xchg word [esp + 0xd], dx
lea esp, [esp + 1]
call fcn.00878e3c
cmp byte [0x11e69f0c], 0x86
fsub qword [esi - 0x79]
jl 0x878e53
xchg ah, bl
xchg word [esp + 7], di
pop es
mov bx, 0x9f51
sub esp, 0xa
inc bp
xchg ecx, eax
jmp 0x878e11
push esp
invalid
neg ax
mov byte [esp + 0xb], ah
mov eax, dword [esp + 9]
inc edi
rdtsc
cpuid
jmp 0x878e29
Function at 0x879090
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap esi
rdtsc
pop dword [esp + 0x17]
mov byte [esp + 0xf], ch
xchg byte [esp], al
mov byte [esp + 0x25], bh
jmp 0x8790ab
mov dl, dh
setae dh
sub si, 0x49f0
lea esi, [esp + eax]
rdtsc
not esi
jmp 0x87903b
mov dl, 0xbc
add al, dh
neg bh
mov dl, 0x94
mov bp, 0xedb9
mov eax, 0x8a2714d2
jmp 0x879055
jmp 0x87906c
mov dl, 0xac
add esp, 5
call fcn.00879151
call 0x8790a1
jmp 0x87a00d
pop esi
clc
mov eax, 0xd8530d1a
mov word [esp + 0x1f], sp
rdtsc
not ebp
jmp 0x879092
pop eax
sub eax, 0x8790a1
jmp 0x87a15f
mov dword [ebx], eax
popal
jmp fcn.00877363
mov ebx, eax
add eax, 0x7503ed
add ebx, sym.imp.KERNEL32.dll_CreateThread
jmp 0x87a0d6

Function at 0x87b6ab
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
lea esp, [esp + 0x54]
jmp 0x87b705
pop dword [esp + 2]
push edx
lea esp, [esp + 1]
lea esp, [esp + 3]
mov dword [esp + 0x54], edi
jmp 0x87b692
mov eax, dword [eax + 0x1c]
jmp 0x87b6d8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x87b6ee
Function at 0x43a970
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2f000]
push edi
jmp 0x43a98a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43a991
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43a980
mov eax, 1
add ebx, ebx
jne 0x43a9a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43a998
jne 0x43a9b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43a998
xor ecx, ecx
sub eax, 3
jb 0x43a9c8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43aa3a
mov ebp, eax
add ebx, ebx
jne 0x43a9d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43a9e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43aa04
inc ecx
add ebx, ebx
jne 0x43a9f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43a9e5
jne 0x43aa01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43a9e5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43aa24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43aa15
jmp 0x43a986
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43aa24
add edi, ecx
jmp 0x43a986
pop esi
mov edi, esi
mov ecx, 0x6d0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43aa42
cmp byte [edi], 0x11
jne 0x43aa42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43aa47
lea edi, [esi + 0x38000]
mov eax, dword [edi]
or eax, eax
je 0x43aabf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x51a50]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x51b18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43aa74
mov ecx, edi
jns 0x43aaa3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x51b1c]
or eax, eax
je 0x43aab9
mov dword [ebx], eax
add ebx, 4
jmp 0x43aa91
call dword [esi + 0x51b2c]
mov ebp, dword [esi + 0x51b20]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43aaf3
sub esp, 0xffffff80
jmp 0x40a7b1
Function at 0x40941c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409455
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004042fc
jmp 0x40945e
mov eax, ebx
mov edx, esi
call fcn.00404260
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409468
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409489
mov al, byte [esp]
jmp 0x40948b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x409b10
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x409988
mov eax, dword [0x452e6c]
cmp byte [eax], 0
je 0x409b78
mov eax, dword [0x452cd0]
call fcn.00402c4c
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408624
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x409bc0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x409bae
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x452c90]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x453714]
call fcn.004058f8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40a618
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40a67c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404474
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408364
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a683
lea eax, [ebp - 0xc]
call fcn.0040420c
ret
Function at 0x41c26c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x453a20
cmp dword [edi], 0
jne 0x41c2e8
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x453a1c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4524bc
mov ecx, 2
call fcn.004028d4
mov edx, 0x41c244
lea eax, [esi + 5]
call fcn.0041c264
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041c264
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41c2bd
mov dword [0x453a1c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41d474
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41d47a
ret

Function at 0x41f934
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41f985
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41f96c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41f95c
jmp 0x41f985
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41f96d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4294a4
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x4293f0
call sub.user32.dll_EnumWindows
ret

Function at 0x4295c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x429645
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00429014
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x4295ed
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00428c6c
cmp dword [ebp - 4], 0
je 0x42962f
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004046bc
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42964c
lea eax, [ebp - 4]
call fcn.0040420c
ret

Function at 0x42c3c8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x453ba8], 0
je 0x42c517
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x452e18]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x42c517
mov eax, dword [0x453bac]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x453ba8]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x42c4e6
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x453ba8]
call fcn.004138e8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x42c4de
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x42c4de
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x42c4de
mov eax, dword [ebp - 0x14]
call fcn.00434ed4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42c4de
push ebp
call fcn.0042c384
pop ecx
test al, al
jne 0x42c4de
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x42c49a
mov eax, dword [ebp - 0x14]
call fcn.00433a68
dec eax
jle 0x42c4de
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004036b4
cmp byte [ebp - 1], 0
je 0x42c4de
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x42c4de
mov edx, dword [ebp - 0x14]
mov eax, dword [0x453bac]
call fcn.0042bb4c
inc edi
dec ebx
jne 0x42c42d
mov eax, dword [0x453bac]
cmp dword [eax + 8], 0
jle 0x42c4fe
mov eax, dword [0x453bac]
call fcn.0042bbdc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42c517
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0042c1ec
pop ecx
test al, al
jne 0x42c517
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42fad4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x42fb20
mov eax, esi
call fcn.00445458
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42fb20
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x42fb20
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x42fc64
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x42fb60
cmp eax, 0x108
ja 0x42fb60
mov eax, esi
call fcn.00445458
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42fc5b
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xec]
test al, al
jne 0x42fc64
jmp 0x42fc5b
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x42fc42
cmp eax, 0x20a
ja 0x42fc42
test byte [esi + 0x50], 0x80
jne 0x42fb92
sub eax, 0x203
je 0x42fb8f
sub eax, 3
je 0x42fb8f
sub eax, 3
jne 0x42fb92
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x42fba6
dec eax
je 0x42fbbb
dec eax
je 0x42fbdb
dec eax
je 0x42fbbb
jmp 0x42fbe2
mov ecx, ebx
mov eax, dword [0x452e18]
mov eax, dword [eax]
mov edx, esi
call fcn.0044eb1c
jmp 0x42fc5b
cmp byte [esi + 0x5d], 1
jne 0x42fbd1
mov eax, esi
mov si, 0xffed
call fcn.004036b4
jmp 0x42fc64
or word [esi + 0x54], 1
jmp 0x42fc5b
and word [esi + 0x54], 0xfffe
jmp 0x42fc5b
mov eax, dword [0x453b64]
cmp byte [eax + 0x20], 0
je 0x42fc5b
mov eax, dword [0x453b64]
cmp dword [eax + 0x1c], 0
je 0x42fc5b
mov eax, dword [ebx]
mov edx, dword [0x453b64]
cmp eax, dword [edx + 0x1c]
jne 0x42fc5b
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.0044539c
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.004036b4
jmp 0x42fc64
mov eax, dword [ebx]
cmp eax, 0xb00b
jne 0x42fc5b
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0042e400
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret