joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005a4a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x10024050]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x10005aed
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.1000435a
pop ecx
pop ecx
test eax, eax
je 0x10005ad6
test ebx, ebx
je 0x10005aca
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.1000435a
pop ecx
pop ecx
test eax, eax
jle 0x10005ad6
push ebx
call fcn.10006dc1
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.10006da0
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x10005a97
xor edi, edi
cmp ebx, edi
jne 0x10005af1
xor eax, eax
jmp 0x10005b5d
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x10005b20
call fcn.10006dc1
pop ecx
cmp dword [ebp - 0x70], edi
je 0x10005aed
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x10005aed
call fcn.10006dc1
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x10005b10
cmp dword [ebp - 0x70], edi
je 0x10005b53
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.10006da0
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008c61
add ebp, 0x9c
leave
ret
Function at 0x10008c61
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10024050]
jne 0x10008c6b
repz ret
jmp fcn.1000d082

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000b197
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
test si, si
jne 0x1000b24c
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1000b24c
mov edx, dword [esi + 0x3c]
test dl, 3
jne 0x1000b24c
cmp dword [edx + esi], 0x4550
jne 0x1000b24c
cmp dword [edx + esi + 0x74], 6
jb 0x1000b24c
push ebx
mov ebx, dword [edx + esi + 0x50]
push edi
mov edi, dword [edx + esi + 0xa8]
lea eax, [ebx - 1]
lea ecx, [edi - 1]
cmp ecx, eax
jae 0x1000b24a
mov eax, dword [edx + esi + 0xac]
mov ecx, ebx
sub ecx, edi
cmp eax, ecx
ja 0x1000b24a
xor edx, edx
add edi, esi
push 0x1c
pop ecx
div ecx
mov edx, eax
test edx, edx
je 0x1000b24a
imul ecx, edx, 0x1c
add ecx, 0x14
add ecx, edi
lea ecx, [ecx - 0x1c]
dec edx
cmp dword [ecx - 8], 2
lea edi, [ecx - 0x14]
jne 0x1000b228
cmp dword [ecx], ebx
jae 0x1000b228
mov eax, ebx
sub eax, dword [ecx]
cmp dword [ecx - 4], eax
jbe 0x1000b22e
test edx, edx
jne 0x1000b20e
jmp 0x1000b24a
push 0x1c
push edi
call dword [sym.imp.kernel32.dll_VirtualLock]
test eax, eax
je 0x1000b24a
mov eax, dword [edi + 0x14]
push dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.kernel32.dll_VirtualLock]
pop edi
pop ebx
pop esi
ret

Function at 0x1000c446
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000c455
pop dword [ebp - 0x3c]
mov eax, 0xf234e29e
sub eax, 0xe2341e49
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3afa1
push 0
mov eax, 0x6f99ea69
sub eax, 0x5f98aa05
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0xc756c16d
add ecx, 0x38a98e94
mov esi, eax
mov edx, 0xabc63e44
add edx, 0x643b47bc
add edx, dword [ebp - 0x3c]
mov ebx, 0x59fe427f
xor dword [ebp - 0x28], esi
mov edi, dword [edx]
xor dword [ebp - 0x34], 0x2921ea68
xor edi, ebx
sub dword [ebp - 0x28], eax
mov dword [esi], edi
xor dword [ebp - 0x18], ebx
add esi, 4
add edx, 0x781e96b6
add edx, 0x87e1694e
loop 0x1000c4ae
add eax, 0xb065bcb5
add eax, 0x4f9b7622
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe593bade
add ecx, 0x2a6c4522
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401100
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442004]
jne 0x40110a
repz ret
jmp fcn.004014dc

Function at 0x408cfc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x442004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404a5e
and dword [ebp - 0x14], 0
cmp dword [0x444c74], 0
mov dword [ebp - 0x18], eax
jne 0x408daf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408e57
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408e57
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x444c74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x444c78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x444c7c], eax
call edi
push eax
call esi
mov dword [0x444c84], eax
test eax, eax
je 0x408daf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x444c80], eax
mov eax, dword [0x444c80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408e08
cmp dword [0x444c84], ecx
je 0x408e08
push eax
call esi
push dword [0x444c84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408e08
test ebx, ebx
je 0x408e08
call edi
test eax, eax
je 0x408dff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408dff
test byte [ebp - 8], 1
jne 0x408e08
or dword [ebp + 0x10], 0x200000
jmp 0x408e3b
mov eax, dword [0x444c78]
cmp eax, dword [ebp - 0x18]
je 0x408e3b
push eax
call esi
test eax, eax
je 0x408e3b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408e3b
mov eax, dword [0x444c7c]
cmp eax, dword [ebp - 0x18]
je 0x408e3b
push eax
call esi
test eax, eax
je 0x408e3b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x444c74]
call esi
test eax, eax
je 0x408e57
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408e59
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401100
leave
ret
Function at 0x437220
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x442004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x442db0]
push ebx
mov ebx, dword [0x2be8234]
push edi
mov edi, dword [0x2bea6b4]
call fcn.00437190
cmp dword [0x2bea6b4], 0x2f
jne 0x43728d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.004371c0
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401100
add esp, 0x24
ret
Function at 0x437580
Capabilities:
Get disk information
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x442004]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
jmp 0x4375a5
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x4375ee
mov dword [0x2bea31c], 0x8e46a6f0
cmp dword [0x2bea6b4], 0x3dc
jne 0x4375ec
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x43759c
mov dword [ebp - 0x10], 0
jmp 0x437600
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x43769b
cmp dword [0x2bea6b4], 0xa5f
jne 0x437652
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x820]
push ecx
push str.xonatoyuhejigoriramadiguyo
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 0x10], 0x84620b
jne 0x437676
mov edx, dword [0x443bd0]
mov dword [0x2bea6b4], edx
mov eax, dword [0x2bea6b4]
add eax, 0xa231
mov dword [0x2bea6b4], eax
cmp dword [0x2bea6b4], 0x141
jne 0x437696
mov dword [0x4451a0], 0xec58acac
mov dword [0x4451a4], 0xffffffff
jmp 0x4375f7
call fcn.004372b0
jmp dword [0x2be8234]
Function at 0x1001aeee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1001aefd
pop dword [ebp - 0x24]
mov eax, 0xf224b3f0
sub eax, 0xe22304f3
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x2cca34b2
add dword [ebp - 0x34], 0x21881099
mov dword [ebp - 0x30], 0x9ed6727b
add dword [ebp - 0x30], 0x935cd9ca
mov dword [ebp - 0x2c], 0x4446f880
sub dword [ebp - 0x2c], 0xf7fab452
mov dword [ebp - 0x28], 0x8268e5d6
sub dword [ebp - 0x28], 0x8268e5d6
lea eax, [ebp - 0x34]
push eax
mov eax, 0x9e220346
sub eax, 0x8e2042c6
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x1fe643d
sub dword [ebp - 0x34], 0x8d8bfae7
mov dword [ebp - 0x30], 0xbf2f05c9
add dword [ebp - 0x30], 0x823d5bac
mov dword [ebp - 0x2c], 0xe8151096
sub dword [ebp - 0x2c], 0x84a5a42a
mov dword [ebp - 0x28], 0x84c23eee
sub dword [ebp - 0x28], 0x84c23eee
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x3e940430
sub eax, 0x2e924430
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x38026
push 0
call eax
mov ecx, 0x4a52
xor edi, edi
add edi, eax
mov esi, 0xd9bb1007
sub esi, 0xc9b8a807
add esi, dword [ebp - 0x24]
mov ebx, 0xb9598299
mov edx, dword [esi]
xor dword [ebp - 0xc], 0xfedd9ef0
add edx, ebx
add dword [ebp - 0x20], eax
mov dword [edi], edx
add edi, 4
add esi, 0x588f6c10
sub esi, 0x588f6c0c
loop 0x1001b015
add eax, 0x11c1b
mov ebx, eax
add eax, 0x2bcad1f3
add eax, 0xd4352e12
mov ecx, 0x14abfd60
add ecx, 0xfb5402a0
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x402b08
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404318
test esi, esi
jne 0x402b3e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404408
jmp 0x402b5c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a1c
mov edi, eax
test esi, esi
je 0x402b5c
cmp dword [ebx], 0
je 0x402b5c
dec esi
jmp 0x402b45
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4032cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4ad020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403364
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403344
xor eax, eax
push ebp
push 0x40333d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403380
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403344
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4ad020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4ad020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040f8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4b004c], 0
je 0x404159
cmp word [0x4b0220], 0xd7b2
jne 0x404121
cmp dword [0x4b0228], 0
jbe 0x404121
mov eax, 0x4b021c
call dword [0x4b0238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4ad06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404180
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4ad030], 0
jne 0x404175
push 0
push 0x4ad064
push 0x4ad06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4042cc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004027e0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4b004d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404294
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4066f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406756
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404588
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402e60
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406740
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40675d
lea eax, [ebp - 0x10]
call fcn.00404318
ret

Function at 0x40c498
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c4d1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404408
jmp 0x40c4da
mov eax, ebx
mov edx, esi
call fcn.0040436c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c4e4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c505
mov al, byte [esp]
jmp 0x40c507
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40cb8c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ca04
mov eax, dword [0x4af95c]
cmp byte [eax], 0
je 0x40cc08
mov eax, dword [0x4af520]
call fcn.00402c24
call fcn.00402948
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409620
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40cc50
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40cc3e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4af470]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4b0668]
call fcn.00405be8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40d510
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d5e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004043b0
lea eax, [ebp - 8]
call fcn.00404828
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004047d8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d5d0
mov eax, ebx
call fcn.004027e0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d5c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004047d8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d5b3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d5f8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d5b3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d5d0
mov eax, dword [ebp - 0x10]
call fcn.00402800
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d5ed
lea eax, [ebp - 8]
call fcn.00404318
ret

Function at 0x40dad8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40db3c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404588
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409098
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40db43
lea eax, [ebp - 0xc]
call fcn.00404318
ret

Function at 0x423e7c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00423cd4
dec esi
jne 0x423e9e
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x424fe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4b088c
cmp dword [edi], 0
jne 0x42505c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4b0888]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4ad6cc
mov ecx, 2
call fcn.004029dc
mov edx, 0x424fb8
lea eax, [esi + 5]
call fcn.00424fd8
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00424fd8
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x425031
mov dword [0x4b0888], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x426280
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x426286
ret

Function at 0x428700
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x428751
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x428738
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x428728
jmp 0x428751
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x428739
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a29c
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x43a1e8
call sub.user32.dll_EnumWindows
ret

Function at 0x43a3bc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x43a439
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00439e1c
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x43a3e1
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00439a1c
cmp dword [ebp - 4], 0
je 0x43a423
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004047d8
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a440
lea eax, [ebp - 4]
call fcn.00404318
ret

Function at 0x43d760
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4b0b5c], 0
je 0x43d8af
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4af890]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x43d8af
mov eax, dword [0x4b0b60]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4b0b5c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x43d87e
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4b0b5c]
call fcn.0041d368
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x43d876
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x43d876
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x43d876
mov eax, dword [ebp - 0x14]
call fcn.004463f8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43d876
push ebp
call fcn.0043d71c
pop ecx
test al, al
jne 0x43d876
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x43d832
mov eax, dword [ebp - 0x14]
call fcn.00444f28
dec eax
jle 0x43d876
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00403658
cmp byte [ebp - 1], 0
je 0x43d876
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x43d876
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4b0b60]
call fcn.0043cee8
inc edi
dec ebx
jne 0x43d7c5
mov eax, dword [0x4b0b60]
cmp dword [eax + 8], 0
jle 0x43d896
mov eax, dword [0x4b0b60]
call fcn.0043cf78
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43d8af
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0043d584
pop ecx
test al, al
jne 0x43d8af
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret