joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4046e7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x807400]
jne 0x4046f1
repz ret
jmp fcn.004074bb

Function at 0x4070ed
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004040ee
and dword [ebp - 4], 0
cmp dword [0x809efc], 0
mov ebx, eax
jne 0x40719e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40724f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40724f
push eax
call fcn.0040407c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x809efc], eax
call esi
push eax
call fcn.0040407c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x809f00], eax
call esi
push eax
call fcn.0040407c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x809f04], eax
call esi
push eax
call fcn.0040407c
pop ecx
mov dword [0x809f0c], eax
test eax, eax
je 0x40719e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040407c
pop ecx
mov dword [0x809f08], eax
mov eax, dword [0x809f08]
cmp eax, ebx
je 0x4071f6
cmp dword [0x809f0c], ebx
je 0x4071f6
push eax
call fcn.004040f7
push dword [0x809f0c]
mov esi, eax
call fcn.004040f7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4071f6
test edi, edi
je 0x4071f6
call esi
test eax, eax
je 0x4071ed
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4071ed
test byte [ebp - 0xc], 1
jne 0x4071f6
or dword [ebp + 0x10], 0x200000
jmp 0x40722f
mov eax, dword [0x809f00]
cmp eax, ebx
je 0x40722f
push eax
call fcn.004040f7
pop ecx
test eax, eax
je 0x40722f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40722f
mov eax, dword [0x809f04]
cmp eax, ebx
je 0x40722f
push eax
call fcn.004040f7
pop ecx
test eax, eax
je 0x40722f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x809efc]
call fcn.004040f7
pop ecx
test eax, eax
je 0x40724f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407251
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4014d9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x254
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
call ebx
mov dword [ebp - 0x21c], 6
push edx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push ecx
push ecx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x220], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push edx
push edx
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push ecx
mov dword [esp], 0
call ebx
push ebx
lea ebx, [ebp - 0x210]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push eax
push eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
push eax
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push eax
push eax
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
lea eax, [ebx - 3]
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4016dd
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 0
call fcn.004014d9
test eax, eax
jne 0x401777
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x4021e2
sub eax, 0x401780
mov dword [esp], 0x401780
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x401777
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401446
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.0040164f
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1ba00
mov dword [esp], 0x40300c
call fcn.00401ee5
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4accfd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4acd35
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004aada1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004aad79
jmp 0x4acd41
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4ae3ef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4ae431
call fcn.004b402e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x4ae431
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x4ae428
xor eax, eax
jmp 0x4ae439
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004ae43f
pop edi
pop esi
pop ebx
ret 4

Function at 0x4b455e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b458c
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x4b45aa
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b44c4
jmp 0x4b45aa
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b45aa
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b44c4
test edi, edi
mov eax, edi
jne 0x4b4594
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x452f4a3e
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x3f94751
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x445d37
Capabilities:
Encode data using xor

Disassembly:
jns 0x445cf4
lahf
xchg byte [eax + 0x59], ch
stc
and eax, 0x73a2df68
or byte [ebp - 0x2c8c6bbe], al
Function at 0x490c0f
Capabilities:
Encode data using xor

Disassembly:
mov ah, 0x71
lcall 0x37e0, 0xb8bc323
aaa

Function at 0x4e18f0
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov al, byte [0x65f037]
xor al, byte [0x65f030]
mov byte [0x65f037], al
mov ecx, dword [0x65f024]
mov edx, dword [0x65f020]
lea eax, [edx + ecx*2]
mov dword [0x65f020], eax
xor ecx, ecx
mov cl, byte [0x65f037]
mov edx, dword [0x65f028]
and edx, 3
imul ecx, edx
mov eax, dword [0x65f024]
add eax, ecx
mov dword [0x65f024], eax
mov dword [ebp - 0x1c], 0x5a4d
mov dword [ebp - 0xc], 0x4550
mov cl, byte [0x65f030]
and cl, byte [0x65f03e]
mov byte [0x65f030], cl
xor edx, edx
mov dl, byte [0x65f030]
sar edx, 1
or edx, 2
mov dword [ebp - 0x20], edx
fild dword [ebp - 0x20]
fdivr qword [0x65f040]
fstp qword [0x65fbd0]
cmp dword [0x65f020], 0x367
je 0x4e19a8
fld qword [0x65fbd0]
fadd qword [0x65b848]
fstp qword [0x65fbd0]
invalid
mov eax, dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x65f024]
shl ecx, 1
or ecx, dword [0x65f020]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0
fild qword [ebp - 0x28]
fadd qword [0x65f040]
fstp qword [0x65f040]
mov edx, dword [0xa5ff38]
cmp edx, dword [0x65f020]
je 0x4e19f5
mov eax, dword [0x65f020]
xor eax, dword [0xa5ff38]
mov dword [0x65f020], eax
jmp 0x4e1fdf
mov cl, byte [0x65f036]
xor cl, byte [0x65f037]
mov byte [0x65f036], cl
mov edx, dword [0x65f028]
shr edx, 1
mov eax, dword [0x65f02c]
add eax, edx
mov dword [0x65f02c], eax
xor ecx, ecx
invalid
invalid
aaa
invalid
invalid
Function at 0x4e19a7
Capabilities:
Accept command line arguments
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov al, byte [0x65f037]
xor al, byte [0x65f030]
mov byte [0x65f037], al
mov ecx, dword [0x65f024]
mov edx, dword [0x65f020]
lea eax, [edx + ecx*2]
mov dword [0x65f020], eax
xor ecx, ecx
mov cl, byte [0x65f037]
mov edx, dword [0x65f028]
and edx, 3
imul ecx, edx
mov eax, dword [0x65f024]
add eax, ecx
mov dword [0x65f024], eax
mov dword [ebp - 0x1c], 0x5a4d
mov dword [ebp - 0xc], 0x4550
mov cl, byte [0x65f030]
and cl, byte [0x65f03e]
mov byte [0x65f030], cl
xor edx, edx
mov dl, byte [0x65f030]
sar edx, 1
or edx, 2
mov dword [ebp - 0x20], edx
fild dword [ebp - 0x20]
fdivr qword [0x65f040]
fstp qword [0x65fbd0]
cmp dword [0x65f020], 0x367
je 0x4e19a8
fld qword [0x65fbd0]
fadd qword [0x65b848]
fstp qword [0x65fbd0]
invalid
mov eax, dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x65f024]
shl ecx, 1
or ecx, dword [0x65f020]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0
fild qword [ebp - 0x28]
fadd qword [0x65f040]
fstp qword [0x65f040]
mov edx, dword [0xa5ff38]
cmp edx, dword [0x65f020]
je 0x4e19f5
mov eax, dword [0x65f020]
xor eax, dword [0xa5ff38]
mov dword [0x65f020], eax
jmp 0x4e1fdf
mov cl, byte [0x65f036]
xor cl, byte [0x65f037]
mov byte [0x65f036], cl
mov edx, dword [0x65f028]
shr edx, 1
mov eax, dword [0x65f02c]
add eax, edx
mov dword [0x65f02c], eax
xor ecx, ecx
invalid
invalid
aaa
invalid
invalid
Function at 0x571d77
Capabilities:
Encode data using xor

Disassembly:
xor dh, byte [esp + ebx*4 + 0x26f8b3db]
popfd
popfd
jo 0x571d71
mov dh, 9
int3

Function at 0x573f1b
Capabilities:
Encode data using xor

Disassembly:
vmovsd xmm0, qword [esi]
adc byte [ebx + 0x25], dl
add ecx, ecx
pop ebp
das
sbb byte [edx + edi], 0x43
and eax, 0x23132aef
adc esp, dword [ebx]
add byte [esi - 0x46], 0x46
and al, 0xb3
or edi, dword [0x8bcbec9a]
cmp eax, 0x8bcbec9a
push ebp
mov byte [0xb3607905], al
dec ecx
in eax, 0x99
mov ebp, 0x579875d5
pop es
lcall 0xa9ab, 0x3f405b2c
mov bl, 0x70
shl byte [ebx - 0x65], 1
cmp ah, ah
loop 0x573f42
enter 0x3c63, 0xffffffffffffffcb
mov dl, 0x10
xor al, 7
dec ebp
and byte ss:[ecx - 0x5f1c8491], dh
inc edx
wait
jbe 0x573f12
retf
xchg ecx, eax
movsb byte es:[edi], byte [esi]
cmp al, 0x72
xor ebx, 0x47
invalid

Function at 0x57766b
Capabilities:
Encode data using xor

Disassembly:
nop
xchg edi, eax
jo 0x57761a
pop esp
jae 0x577620
jo 0x577622
inc ebp
mov dword [0x6389caa9], eax
or eax, 0xcf50c9c3
push eax
rol byte [esi + 0x29231f16], cl
push eax
iretd
pop ds
and ebp, dword [ecx]
sub dword [eax], esp
xchg ebx, eax
adc al, 0x46
pop ecx
jne 0x577667
and byte [ebx + 0x64594614], dl
jne 0x577667
jg 0x577680
sbb dword ds:[ebx - 0x36], edx
and byte [ecx + ebx - 0x1e712f24], bh
ror byte [ecx], 0x1b
and cl, 0xf9
int 0xc3
pop ebp
cmpsb byte [esi], byte es:[edi]
adc edx, dword [ebp - 0x7a]
cmp ebx, dword [ebx]
arpl word [ecx - 0x23], dx
aam 0xba
arpl sp, sp
sal byte [edx - 0x39], 0xa5
lcall 0xc9e2, 0xf0cbb1dd
inc ebx
mov cl, 0xb9
out 0xdb, al
push eax
wait
and dword [edx + 0x39], ebp
pop ecx
inc ebx
and esi, dword [ebx]
and dl, byte [ebx - 0x356585e9]
jp 0x577607
retf 0xbe3c
jecxz 0x57766f
xor esp, dword [edx]
xchg ebx, eax
pop ss
jp 0x577607
retf 0xbe3c
mov esi, 0x5d7fde3
mov dl, 0xcd
xlatb
add eax, 0x61bacdb2
xchg ebp, eax
in al, dx
add al, 0xb7
xlatb
mov edx, 0x4ec9561
mov bh, 0xd7
cmpsd dword [esi], dword es:[edi]
and edx, ebx
sbb dword [ecx + 0x7d726136], ecx
not byte [esi + 0x23136354]
inc eax
out dx, al
lds edx, [edi]
js 0x577676
xchg ecx, eax
pop eax
adc dword gs:[esi - 0x6f703c40], edi
mov eax, dword [0xfc36bfba]
outsd dx, dword [esi]
inc ebx
adc byte [ecx + 0x33], 0x62
sub dword [eax + edx*8 + 0x71], 0xffffffaf
inc esp
or dword [0x934003f5], 0xfffffff0
dec esi
xor ebx, ebp
pop es
inc esi
jno 0x5776ac
fcomp qword [esi - 0x165aa1f1]
imul ebx, dword [ebp + 0x1e], 0x1d32e15
invalid
Function at 0x60eed0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [0x65f020]
mov cl, byte [0x65f037]
mov al, byte [0x65f030]
push ebx
push esi
mov esi, dword [0x65f024]
push edi
xor cl, al
lea edi, [edx + esi*2]
mov edx, dword [0x65f028]
xor ebx, ebx
and edx, 3
mov bl, cl
mov byte [0x65f037], cl
imul edx, ebx
mov bl, byte [0x65f03e]
add esi, edx
and al, bl
mov dword [0x65f020], edi
mov byte [0x65f030], al
or al, 4
shr al, 1
and eax, 0xff
cmp edi, 0x367
mov dword [ebp - 4], eax
mov dword [0x65f024], esi
fild dword [ebp - 4]
fdivr qword [0x65f040]
fstp qword [0x65fbd0]
je 0x60ef5b
fld qword [0x65fbd0]
fadd qword [0x65b848]
fstp qword [0x65fbd0]
mov ebx, dword fs:[0x18]
mov dword [ebp - 4], ebx
mov eax, dword [0x65f024]
xor ebx, ebx
mov dword [ebp - 8], ebx
lea ecx, [eax + eax]
mov eax, dword [0x65f020]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [0xa5ff38]
fild qword [ebp - 0xc]
cmp ecx, eax
fadd qword [0x65f040]
fstp qword [0x65f040]
je 0x60ef9c
xor eax, ecx
mov dword [0x65f020], eax
mov edx, dword [ebp - 4]
mov cl, byte [0x65f037]
mov esi, dword [0x65f028]
mov dword [ebp - 8], ebx
mov eax, dword [edx + 0x30]
mov dl, byte [0x65f036]
xor dl, cl
mov dword [ebp - 4], eax
mov eax, dword [0x65f02c]
invalid
invalid

Function at 0x60ef7b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [0x65f020]
mov cl, byte [0x65f037]
mov al, byte [0x65f030]
push ebx
push esi
mov esi, dword [0x65f024]
push edi
xor cl, al
lea edi, [edx + esi*2]
mov edx, dword [0x65f028]
xor ebx, ebx
and edx, 3
mov bl, cl
mov byte [0x65f037], cl
imul edx, ebx
mov bl, byte [0x65f03e]
add esi, edx
and al, bl
mov dword [0x65f020], edi
mov byte [0x65f030], al
or al, 4
shr al, 1
and eax, 0xff
cmp edi, 0x367
mov dword [ebp - 4], eax
mov dword [0x65f024], esi
fild dword [ebp - 4]
fdivr qword [0x65f040]
fstp qword [0x65fbd0]
je 0x60ef5b
fld qword [0x65fbd0]
fadd qword [0x65b848]
fstp qword [0x65fbd0]
mov ebx, dword fs:[0x18]
mov dword [ebp - 4], ebx
mov eax, dword [0x65f024]
xor ebx, ebx
mov dword [ebp - 8], ebx
lea ecx, [eax + eax]
mov eax, dword [0x65f020]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [0xa5ff38]
fild qword [ebp - 0xc]
cmp ecx, eax
fadd qword [0x65f040]
fstp qword [0x65f040]
je 0x60ef9c
xor eax, ecx
mov dword [0x65f020], eax
mov edx, dword [ebp - 4]
mov cl, byte [0x65f037]
mov esi, dword [0x65f028]
mov dword [ebp - 8], ebx
mov eax, dword [edx + 0x30]
mov dl, byte [0x65f036]
xor dl, cl
mov dword [ebp - 4], eax
mov eax, dword [0x65f02c]
invalid
invalid

Function at 0x60efc3
Capabilities:
Log keystrokes via polling

Disassembly:
lock add byte gs:[ebx + 0x3ead1d6], cl
ret 0xd233

Function at 0x60f513
Capabilities:
Encode data using xor

Disassembly:
sar bl, 1
add byte gs:[ebx], al
fidivr dword [ecx + 0x65fd30]
Function at 0x402cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 3
push ebx
push ebx
push ebx
push 0x404d70
mov dword [ebp - 0xb4], 0xb4
mov dword [ebp - 0xb0], 0x10
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], 0x7b761e52
mov dword [ebp - 0x88], 0x1c94cc7
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x64], 0x20000000
mov dword [ebp - 0x60], 0x1210064
mov dword [ebp - 0x5c], 0x22
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], 0x4d0007
mov dword [ebp - 0x50], 0x730065
mov dword [ebp - 0x4c], 0x610073
mov dword [ebp - 0x48], 0x650067
mov dword [ebp - 0x44], 0x420000
mov dword [ebp - 0x40], 0xb0022
mov dword [ebp - 0x3c], 0x490000
mov dword [ebp - 0x38], 0x530053
mov dword [ebp - 0x34], 0x560045
mov dword [ebp - 0x30], 0x4e0045
mov dword [ebp - 0x2c], 0x490054
mov dword [ebp - 0x28], 0x3d0044
mov dword [ebp - 0x24], 0x300034
mov dword [ebp - 0x20], 0x320030
mov dword [ebp - 0x1c], 0x650000
mov dword [ebp - 0x18], 0x70006d
mov dword [ebp - 0x14], 0x790074
mov dword [ebp - 0x10], 0x45003d
mov dword [ebp - 0xc], 0x70006d
mov dword [ebp - 8], 0x790074
mov dword [ebp - 4], ebx
call dword [0x40407c]
mov esi, eax
cmp esi, 0xffffffff
je 0x402e30
push ebx
lea eax, [ebp - 0xbc]
push eax
push 4
lea ecx, [ebp - 0xb8]
push ecx
push 0xb4
lea edx, [ebp - 0xb4]
push edx
push 0x86000054
push esi
call dword [0x404044]
push esi
call dword [0x404114]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4029c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
test eax, eax
mov dword [ebp - 0x1c], 0x40152c
mov dword [ebp - 0x18], 0x40149c
mov dword [ebp - 0x14], 0x4014a4
je 0x4029ec
and byte [eax], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push edi
lea eax, [ebp - 0x124]
push 0x4012a4
push eax
call ebx
and dword [ebp - 8], 0
lea edi, [ebp - 0x1c]
mov esi, dword [edi]
lea eax, [ebp - 0x124]
push esi
push eax
call fcn.00403529
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x124]
push 0
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402ac0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0x401520
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402ab1
lea eax, [ebp - 0x228]
push 0x4014ac
push eax
call fcn.00403529
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.004035ba
test eax, eax
je 0x402ab1
push dword [ebp + 8]
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402ab1
cmp dword [ebp + 0xc], eax
je 0x402aaa
push esi
push dword [ebp + 0xc]
call ebx
mov dword [ebp - 4], 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 1
je 0x402adc
lea eax, [ebp - 0x124]
push eax
call fcn.00403560
inc dword [ebp - 8]
add edi, 4
cmp dword [ebp - 8], 3
jb 0x402a0a
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x402ae6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
lea eax, [ebp - 0x20c]
push 0x4012a4
push eax
call ebx
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
jne 0x402b12
mov eax, 0x40152c
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00403529
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
push edi
push 2
push edi
push edi
lea eax, [ebp - 0x20c]
push edi
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402ba8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp + 8]
call esi
inc eax
push eax
push dword [ebp + 8]
push 1
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x401520
push dword [ebp - 4]
call edi
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call ebx
lea eax, [ebp - 0x108]
push eax
call fcn.00403560
lea eax, [ebp - 0x108]
push eax
call esi
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push 0x401530
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebx
leave
ret 8