joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a9590
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
jne 0x5a96fd
cmp dword [esi + 0x20], eax
je 0x5a96fd
mov eax, dword [esp + 0x28]
push ebx
push ebp
push edi
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x10], 0
call ebp
mov ebx, eax
lea edi, [esi + 0x10]
cmp dword [esi + 0x20], 0
je 0x5a95ee
call ebp
sub eax, ebx
cmp eax, 0x14
jbe 0x5a95ee
call ebp
mov edx, dword [esi]
mov ebx, eax
mov eax, dword [edx + 0x18]
push 1
mov ecx, esi
call eax
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
push edi
call dword [sym.imp.USER32.dll_PtInRect]
cmp eax, dword [esi + 0x24]
je 0x5a9614
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x24], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x38]
push 1
push edi
call edx
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x5a95d0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetMessageW]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esp + 0x34]
jne 0x5a96a2
mov eax, dword [esp + 0x18]
cmp eax, 0x200
ja 0x5a9686
je 0x5a966e
cmp eax, 0x1f
je 0x5a96b6
cmp eax, 0x100
jne 0x5a9692
cmp dword [esp + 0x1c], 0x1b
jne 0x5a95d0
jmp 0x5a96b6
mov eax, dword [esp + 0x20]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
jmp 0x5a95d0
sub eax, 0x202
je 0x5a96af
sub eax, 2
je 0x5a96b6
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x5a95d0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x5a96b6
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push edx
push eax
push ecx
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x24], 0
call fcn.005a91a0
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx + 0x38]
push 0
push 0
call eax
cmp dword [esp + 0x10], 0
pop edi
pop ebp
pop ebx
je 0x5a96fd
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
push 0
mov ecx, esi
call eax
pop esi
add esp, 0x20
ret 0xc
Function at 0x5ac210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e91b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CXTPMarkupType.0
mov ecx, dword [esi + 0x30]
mov dword [esp + 0x14], 0
test ecx, ecx
je 0x5ac252
call fcn.005ab650
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.005ab5f0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x5acf90
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
push eax
mov esi, ecx
call sub.mfc90u.dll_HashKey_wchar_t_const__
movzx ecx, word [edi + 6]
mov ebx, dword [esp + 0x18]
and eax, ecx
mov dword [ebx], eax
xor edx, edx
div dword [esi + 8]
mov eax, dword [esp + 0x14]
mov dword [eax], edx
mov esi, dword [esi + 4]
test esi, esi
je 0x5acfdf
mov esi, dword [esi + edx*4]
test esi, esi
je 0x5acfdf
mov ecx, dword [esi + 0x10]
cmp ecx, dword [ebx]
jne 0x5acfd8
push edi
push esi
call fcn.005ac090
test eax, eax
jne 0x5acfe7
mov esi, dword [esi + 0xc]
test esi, esi
jne 0x5acfc6
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc

Function at 0x5adc60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e91b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.005ab5d0
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x18], edx
mov edx, dword [esp + 0x24]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x28]
xor ecx, ecx
mov dword [esi + 0x28], edx
mov edx, dword [esp + 0x2c]
push esi
push eax
mov dword [esp + 0x1c], ecx
mov dword [esi], vtable.CXTPMarkupType.0
mov dword [esi + 0x14], eax
mov dword [esi + 0x2c], edx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x30], ecx
call fcn.005ad730
mov ecx, eax
call fcn.005adc30
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14

Function at 0x5aeb20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e94d8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0xc]
call fcn.005adfa0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x48]
mov dword [eax + 8], ecx
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0
mov dword [eax + 0xc], edx
call fcn.005ae8e0
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.005ab5f0
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 0x14
Function at 0x5b3580
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5e97c0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x280]
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x44]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 0x27c]
mov ecx, dword [eax + 0x44]
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 0x48]
mov dword [esp + 0x18], edx
mov ecx, dword [eax + 0x4c]
mov dword [esp + 0x1c], ecx
mov edx, dword [eax + 0x50]
mov ecx, dword [esi + 0x280]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x24], edx
call sub.mfc90u.dll_CWnd::ClientToScreen
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.00552fb0
mov ecx, eax
call fcn.00552b00
mov ecx, dword [esi + 0x280]
mov eax, dword [ecx]
mov edx, dword [eax + 0x238]
call edx
mov edi, dword [esp + 0x4c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esi + 0x1a0]
mov ebx, eax
mov eax, dword [esp + 0x44]
sub edi, eax
cmp eax, ecx
mov dword [esi + 0x190], edx
mov dword [esi + 0x18c], eax
jge 0x5b3646
sub eax, ecx
add edi, eax
mov dword [esi + 0x18c], ecx
mov ecx, dword [esi + 0x18c]
mov eax, dword [esp + 0x3c]
lea ebp, [ecx + edi]
cmp ebp, eax
jle 0x5b365e
sub eax, ecx
sub eax, 4
mov edi, eax
add edx, ebx
cmp edx, dword [esp + 0x40]
jle 0x5b3674
mov eax, dword [esi + 0x198]
sub eax, ebx
mov dword [esi + 0x190], eax
push esi
lea ecx, [esp + 0x68]
call sub.mfc90u.dll_CClientDC::CClientDC
mov ecx, esi
mov dword [esp + 0x80], 0
call fcn.00538f70
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xf4]
push esi
call eax
push eax
lea ecx, [esp + 0x68]
push ecx
lea ecx, [esp + 0x5c]
call fcn.0055cc20
mov edx, dword [esi]
mov eax, dword [edx + 0x1e4]
mov ecx, esi
mov byte [esp + 0x80], 1
call eax
push ebx
push edi
push 0
push 0
lea ebp, [esi + 0x284]
push ebp
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [esi + 0x288]
mov ecx, dword [ebp]
mov edx, dword [esi + 0x27c]
add eax, 3
add ecx, 4
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], 6
mov dword [esp + 0x30], 3
mov ecx, dword [edx + 0x88]
mov edx, dword [ebp + 8]
sub edx, dword [ebp]
lea eax, [esp + 0x24]
push eax
push 0x40
push edx
lea eax, [esp + 0x70]
push eax
call fcn.005b1f40
add esi, 0x1bc
push esi
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov esi, dword [esp + 0x88]
lea ecx, [esp + 0x54]
mov dword [esi], edi
mov dword [esi + 4], ebx
mov byte [esp + 0x80], 0
call fcn.0055cc60
lea ecx, [esp + 0x64]
mov dword [esp + 0x80], 0xffffffff
call fcn.005df0c0
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 0xc
Function at 0x5b3dd0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push ebp
push esi
mov ebp, 1
push ebp
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x5b3f73
mov eax, dword [esi + 0x100]
push edi
push eax
mov dword [esi + 0xa8], ebp
call fcn.005b3b10
mov edi, eax
mov edx, dword [edi]
mov eax, dword [esi + 0x174]
mov edx, dword [edx]
add esp, 4
push eax
mov ecx, edi
call edx
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov ecx, eax
add ecx, ecx
add ecx, ecx
mov eax, 0xcccccccd
mul ecx
push 0
shr edx, 2
push edx
mov edx, dword [esi + 0x100]
mov eax, dword [edx + 0x20]
push 0x459d
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esi + 0x100]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call sub.mfc90u.dll_CWnd::FromHandle
push ebx
jmp 0x5b3e60
mov eax, dword [esi + 0x100]
test eax, eax
jne 0x5b3e6e
xor ebx, ebx
jmp 0x5b3e71
mov ebx, dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, ebx
jne 0x5b3f2f
mov edx, dword [esi]
mov eax, dword [edx + 0x80]
push 0
mov ecx, esi
call eax
test eax, eax
je 0x5b3f2f
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x5b3f25
mov eax, dword [esp + 0x14]
cmp eax, 0x113
jne 0x5b3f03
cmp dword [esp + 0x18], 0x459d
jne 0x5b3f0a
mov edx, dword [edi]
mov eax, dword [esi + 0x174]
mov edx, dword [edx]
push eax
mov ecx, edi
call edx
test ebp, ebp
je 0x5b3efc
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov ecx, eax
mov eax, 0xcccccccd
mul ecx
push 0
shr edx, 3
push edx
mov edx, dword [esi + 0x100]
mov eax, dword [edx + 0x20]
push 0x459d
push eax
call dword [sym.imp.USER32.dll_SetTimer]
xor ebp, ebp
jmp 0x5b3e60
cmp eax, 0x202
je 0x5b3f2f
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x5b3e60
mov eax, dword [esp + 0x18]
push eax
call sub.mfc90u.dll_AfxPostQuitMessage
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [esi + 0x100]
mov edx, dword [ecx + 0x20]
push 0x459d
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi]
mov edx, dword [eax + 0x80]
xor edi, edi
push edi
mov ecx, esi
mov dword [esi + 0xa8], edi
call edx
pop ebx
test eax, eax
jne 0x5b3f6a
mov dword [esi + 0xa4], edi
push edi
mov ecx, esi
call fcn.0052c6e0
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 0xc
Function at 0x5b9b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push ebp
push esi
mov ebp, dword [edi + 0x3c]
sub ebp, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub ebp, eax
cmp eax, edx
jb 0x5b9b9e
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call sub.MSVCR90.dll_memcpy
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x5b9b71
sub eax, ebx
jmp 0x5b9b73
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x5b9b62
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x5b9b92
sub eax, ebx
jmp 0x5b9b94
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x5b9b83
add ebp, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x5b9bf9
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, ebp
add edx, dword [edi + 0x38]
push edx
call fcn.005b98b0
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x5b9be5
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x5b9bf9
mov edx, dword [edi]
cmp dword [edx + 4], 0
jne 0x5b9b26
pop esi
pop ebp
pop ebx
ret
Function at 0x5bbaf0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x10
push ebx
mov bl, byte [edx + 8]
cmp bl, 3
je 0x5bbc9a
mov ecx, dword [esp + 0x20]
push ebp
mov ebp, dword [edx]
push esi
xor esi, esi
push edi
mov dword [esp + 0x24], esi
test bl, 2
je 0x5bbb48
movzx eax, byte [edx + 9]
movzx esi, byte [ecx]
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 1]
mov dword [esp + 0x10], edi
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 2]
sub eax, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov edi, 3
jmp 0x5bbb5b
movzx eax, byte [ecx + 3]
movzx edi, byte [edx + 9]
sub edi, eax
mov dword [esp + 0x10], edi
mov edi, 1
test bl, 4
je 0x5bbb6f
movzx ecx, byte [ecx + 4]
movzx eax, byte [edx + 9]
sub eax, ecx
mov dword [esp + edi*4 + 0x10], eax
inc edi
xor ecx, ecx
xor eax, eax
cmp edi, ecx
jle case.0x5bbbb6.3
jmp 0x5bbb80
cmp dword [esp + eax*4 + 0x10], ecx
jg 0x5bbb8c
mov dword [esp + eax*4 + 0x10], ecx
jmp 0x5bbb91
mov esi, 1
inc eax
cmp eax, edi
jl 0x5bbb80
cmp si, cx
je case.0x5bbbb6.3
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x5bbbb6.3
movzx eax, byte [eax + 0x5bbcb4]
jmp dword [eax*4 + 0x5bbca0]
mov edx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp edx, ecx
jbe case.0x5bbbb6.3
lea esp, [esp]
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x5bbbd0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [edx + 4]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov ecx, edx
mov eax, 0xf0
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x5bbbb6.3
mov edi, edi
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x5bbc10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x5bbbb6.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [esp + edx*4 + 0x10]
shr byte [esi - 1], cl
cmp ebx, ebp
jb 0x5bbc36
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x5bbbb6.3
mov edi, edi
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, 0x100
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [esp + edx*4 + 0x10]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, ebp
jb 0x5bbc60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x5c49f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebx + 0x100]
test esi, esi
je 0x5c4a85
push ebp
mov ebp, dword [esp + 0x10]
mov eax, ebp
shr eax, 8
push edi
mov edi, dword [esi + 0x34]
cmp al, 2
jne 0x5c4a83
test edi, edi
je 0x5c4a83
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
lea eax, [esi + 4]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x5c4a35
mov eax, dword [edi + 0x2c]
jmp 0x5c4a5d
mov ecx, dword [esi + 0x34]
cmp dword [ecx + 0x58], 0
mov ecx, dword [esp + 0x1c]
jne 0x5c4a46
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 0x1c]
add eax, ecx
mov ecx, dword [edi + 0x40]
cmp eax, ecx
jl 0x5c4a5b
mov edx, dword [edi + 0x3c]
add ecx, edx
cmp eax, ecx
jl 0x5c4a5d
mov eax, ecx
push eax
mov ecx, ebx
call fcn.005c4970
cmp ebp, 0x202
je 0x5c4a7a
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x5c4a83
push 0
mov ecx, ebx
call fcn.005c48f0
pop edi
pop ebp
pop esi
pop ebx
ret 0xc

Function at 0x5c4fe0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, ecx
mov dword [ebx + 8], 1
call fcn.005c30d0
test eax, eax
je 0x5c5036
push edi
push esi
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.005c0fa0
push 0x10
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
mov eax, dword [edi + 4]
setl cl
lea edx, [esi + 0xa4]
push ecx
mov ecx, dword [edi]
push edx
mov edx, dword [ebx + 0xc]
push eax
push ecx
push edx
mov ecx, esi
call fcn.005c4c40
pop edi
pop esi
pop ebx
add esp, 8
ret 4
Function at 0x5c9990
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ea278
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CXTPMarkupRun.0
mov ecx, dword [esi + 0x30]
mov dword [esp + 0x14], 0
test ecx, ecx
je 0x5c99d9
call fcn.005ab650
mov dword [esi + 0x30], 0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.005c98b0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5e038a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x72d630]
jne 0x5e0394
repz ret
jmp fcn.005e0a59
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x401510
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x478690]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4015a5
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x401562
cmp dword [ebp + 0x10], ebx
jne 0x401599
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call fcn.00401510
test eax, eax
jne 0x401574
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x401549
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405d97
cmp eax, ebx
je 0x4015ac
push ebx
push dword [0x478690]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x4015a5
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x478690], ebx
jne 0x4015a2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x4015a2
jmp 0x4015a5
Function at 0x402f60
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x402f80
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x402f8f
mov ebx, 0x422130
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402fa4
mov ecx, dword [0x4785f8]
add ecx, eax
push ecx
call fcn.00402f49
push 4
lea eax, [ebp + 0x14]
push eax
call fcn.00402f17
test eax, eax
jne 0x402fbb
push 0xfffffffffffffffd
pop eax
jmp 0x40311a
test dword [ebp + 0x14], 0x80000000
je 0x4030f9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x432138
mov dword [ebp - 0xc], eax
call fcn.00406982
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x403117
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402ffb
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x41e130
push edi
call fcn.00402f17
test eax, eax
je 0x402fb3
sub dword [ebp + 0x14], esi
mov dword [0x432150], edi
mov dword [0x432154], esi
mov eax, dword [ebp - 8]
mov ecx, 0x432138
mov dword [0x432158], ebx
mov dword [0x43215c], eax
call fcn.004069a2
mov dword [ebp - 0x10], eax
test eax, eax
jl 0x4030eb
mov esi, dword [0x432158]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x478694], 1
mov edi, eax
je 0x40309f
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x403066
cmp dword [ebp + 0x14], 0
jne 0x40309f
push dword [ebp + 8]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x94]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
push 0
call fcn.00404a54
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x4030e0
cmp dword [ebp + 0x10], eax
jne 0x4030c8
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4030f2
cmp dword [ebp - 0x14], esi
jne 0x4030f2
add dword [ebp - 4], esi
jmp 0x4030d4
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [0x432158]
cmp dword [ebp - 0x10], 1
jne 0x40301a
jmp 0x403117
cmp dword [ebp + 0x14], eax
jg 0x402fee
jmp 0x403117
push 0xfffffffffffffffc
jmp 0x402fb5
push 0xfffffffffffffffe
jmp 0x402fb5
test edi, edi
je 0x403160
cmp dword [ebp + 0x14], esi
jge 0x403105
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00402f17
test eax, eax
je 0x402fb3
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x40312c
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x41e130
push edi
call fcn.00402f17
test eax, eax
je 0x402fb3
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4030f2
cmp esi, dword [ebp + 0x10]
jne 0x4030f2
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x403121
jmp 0x403117