joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a8d
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret
Function at 0x404674
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
je 0x4046f1
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4046f1
xor eax, eax
xor ebx, ebx
mov word [esi], ax
lea eax, [ebp - 8]
push eax
push 1
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4046f1
mov eax, dword [ebp + 0xc]
push edi
lea edi, [eax + eax]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push esi
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4046d8
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jae 0x4046e8
xor ecx, ecx
mov word [esi + eax*2], cx
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
mov word [edi + esi - 2], ax
jmp 0x4046d6
xor al, al
jmp 0x4046e4
Function at 0x4056aa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x444778
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042ec14
add esp, 0x10
leave
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov edx, dword [ecx]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x4056d0

Function at 0x40725c
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x407284
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x407276
pop edi
pop esi
pop ebp
ret 4
Function at 0x409fe0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0x40a05b
mov ebx, dword [ebp + 0xc]
xor edi, edi
test ebx, ebx
je 0x40a01c
mov ecx, dword [esi + 0xc]
lea ebx, [ebx]
cmp ecx, dword [esi + 8]
je 0x40a02c
mov eax, dword [esi + 4]
mov al, byte [ecx + eax]
mov ecx, dword [ebp + 8]
mov byte [edi + ecx], al
inc edi
inc dword [esi + 0xc]
mov ecx, dword [esi + 0xc]
cmp edi, ebx
jb 0x40a000
add dword [esi + 0x10], edi
mov eax, edi
pop edi
adc dword [esi + 0x14], 0
pop esi
pop ebx
pop ebp
ret 8
push 0
lea eax, [ebp + 0xc]
push eax
push 0x10000
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a01c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40a01c
mov dword [esi + 8], eax
xor ecx, ecx
mov dword [esi + 0xc], 0
jmp 0x40a005
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0041f010
jmp 0x409fee
Function at 0x41a7aa
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
push esi
xor esi, esi
inc ebx
push edi
mov dword [ebp - 0xc], esi
cmp dword [edx + 4], eax
je 0x41a8bf
mov ecx, dword [ebp + 0x1c]
xor edx, edx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], 0x23
mov byte [ecx], dl
mov ecx, dword [ebp + 0x18]
mov dword [edi], edx
mov edi, dword [ebp + 8]
mov byte [ecx], dl
mov ecx, dword [ebp + 0x14]
mov byte [ecx], dl
mov ecx, dword [ebp + 0x10]
mov byte [ecx], dl
push eax
mov ecx, edi
call fcn.00403e19
push 0x2b
pop ecx
push 0x5e
movzx eax, word [eax]
cmp ax, cx
pop ecx
push 0x21
pop edx
je 0x45834d
cmp ax, cx
je 0x45834d
cmp ax, dx
je 0x45834d
cmp ax, word [ebp - 8]
je 0x45834d
lea eax, [esi + 1]
mov ecx, edi
push esi
mov dword [ebp + 0x1c], eax
call fcn.00403e19
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp + 0xc]
movzx eax, word [eax]
cmp eax, 0x7b
jne 0x4583df
push 0x40
lea ecx, [ebp - 0x1c]
call fcn.004069c4
mov edx, dword [ebp + 8]
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x7d
pop ecx
call fcn.0041a8c3
pop ecx
pop ecx
test al, al
je 0x41a8bb
push dword [ebp - 0x1c]
push dword [esi*4 + 0x4b21c0]
call fcn.00424d78
pop ecx
pop ecx
test eax, eax
je 0x41a888
inc esi
cmp esi, 0x63
jl 0x41a86d
cmp esi, 0x63
je 0x458389
cmp byte [esi + 0x4b2158], 0
jne 0x41a8bb
movzx eax, byte [esi + str._f_b_b..__reepqrstuvwxyz________t___]
mov dword [edi], eax
lea ecx, [ebp - 0x1c]
call fcn.0040ac28
mov eax, dword [edi]
movzx ecx, al
mov al, bl
mov dword [edi], ecx
pop edi
pop esi
pop ebx
leave
ret 0x18
xor bl, bl
jmp 0x41a8a3
xor al, al
jmp 0x41a8b4
push 0x2b
pop esi
cmp ax, si
jne 0x45835a
mov eax, dword [ebp + 0x10]
jmp 0x458379
cmp ax, cx
jne 0x458364
mov eax, dword [ebp + 0x14]
jmp 0x458379
cmp ax, dx
jne 0x45836e
mov eax, dword [ebp + 0x18]
jmp 0x458379
push 0x23
pop ecx
cmp ax, cx
jne 0x45837b
mov eax, dword [ebp + 0x1c]
mov byte [eax], bl
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov esi, eax
jmp 0x41a7f1
push 0
lea ecx, [ebp - 0x1c]
call fcn.004053e8
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x4583b2
lea ecx, [ebp - 0x1c]
call fcn.0040ac28
jmp 0x41a8bf
test eax, 0x200
je 0x4583be
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x4583ca
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x41a8a3
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0x41a8a3
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x41a8bf
test eax, 0x200
je 0x4583fe
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x45840a
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x41a8ad
mov ecx, dword [ebp + 0x10]
mov byte [ecx], bl
jmp 0x41a8ad
Function at 0x41bfcd
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4d2353]
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], al
push 0x8000
push edi
mov esi, edx
call fcn.0042dca5
pop ecx
push eax
call fcn.0042dac6
cmp dword [esi + 0xc], 0xb
mov ebx, eax
pop ecx
pop ecx
je 0x458fbd
lea ecx, [ebp - 0x18]
call fcn.0041c0af
mov ecx, esi
call fcn.00407e30
mov ecx, dword [esi + 8]
lea edx, [ebp - 0x18]
call fcn.0041fac6
push dword [ebp - 0x18]
push 0x49e104
push edi
call fcn.0041c0dd
add esp, 0xc
mov dword [ebp - 8], eax
cmp byte [ebp - 1], 0
jne 0x458fdd
lea ecx, [ebp - 0x18]
call fcn.0040ac28
mov esi, dword [ebp - 8]
push edi
call fcn.0042e0e9
push edi
call fcn.0042dca5
pop ecx
pop ecx
cmp ebx, 0xffffffff
jne 0x41c05d
mov ebx, 0x4000
push ebx
push eax
call fcn.0042dac6
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
push edi
mov ecx, esi
call fcn.004725ef
push eax
push 1
call fcn.0047257f
push eax
call fcn.0042df03
add esp, 0x10
mov esi, eax
jmp 0x41c045
mov ecx, esi
call fcn.00407e30
mov eax, dword [esi + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x41c03a
Function at 0x41f596
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x45f928
mov ecx, dword [0x4d293c]
push esi
push edi
cmp ecx, 0xffffffff
je 0x41f648
mov eax, dword [0x4d2930]
xor edx, edx
mov eax, dword [eax + ecx*4]
mov esi, dword [eax]
mov ecx, dword [esi]
mov dword [ebp + 0xc], ecx
cmp byte [esi + 0x3a], dl
je 0x41f5d9
mov byte [esi + 0x3a], dl
cmp dword [esi + 0x18c], edx
jge 0x45f942
mov edi, dword [ebp + 8]
cmp edi, 8
jg 0x45f99c
je 0x41f609
test edi, edi
je 0x45f98b
cmp edi, 1
je 0x41f609
cmp edi, 2
je 0x41f63f
cmp edi, 3
je 0x41f636
jle 0x41f62d
cmp edi, 5
jg 0x45f96a
cmp byte [esi + 0x38], 0
jne 0x41f648
push edi
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, 8
je 0x41f629
cmp edi, 4
je 0x41f629
mov ecx, dword [ebp + 0xc]
call fcn.0041f64c
mov byte [esi + 0x38], 1
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 8
mov byte [esi + 0x38], 1
jmp 0x45f9f7
mov byte [esi + 0x38], 1
jmp 0x45f973
xor eax, eax
jmp 0x41f630
push dword [ebp + 0xc]
mov ecx, 0x4d28d0
call fcn.00419dd1
mov ecx, eax
mov dword [0x4d293c], ecx
jmp 0x41f5a9
cmp byte [esi + 0x198], dl
je 0x41f5d9
push dword [esi + 0x194]
push esi
call fcn.004988c7
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov byte [esi + 0x198], dl
jmp 0x41f5d9
cmp edi, 6
jne 0x41f62d
cmp byte [esi + 0x38], 0
je 0x41f648
push 6
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41f62d
push edx
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi + 0x38], 0
jmp 0x41f62d
mov eax, edi
sub eax, 9
je 0x45f9f7
sub eax, 0x37
je 0x45f9e9
sub eax, 1
je 0x45f9e6
sub eax, 1
je 0x45f9d6
sub eax, 1
jne 0x41f62d
push edx
mov byte [esi + 0x39], dl
call dword [sym.imp.USER32.dll_LockWindowUpdate]
push 1
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x41f62d
push ecx
mov byte [esi + 0x39], 1
call dword [sym.imp.USER32.dll_LockWindowUpdate]
jmp 0x41f62d
push edx
jmp 0x45f9eb
push 1
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x41f62d
cmp byte [esi + 0x38], 0
je 0x41f648
push edi
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 0xc]
call fcn.0041f64c
jmp 0x41f62d
Function at 0x41f64c
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp ebx, esi
je 0x41f765
push edi
xor edi, edi
test esi, esi
jne 0x41f67b
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push ebx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x45fa16
push ebx
mov dword [ebp - 0x10], edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x41f773
push edi
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebx
mov dword [ebp - 4], eax
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
call esi
push 1
push edi
push dword [ebp - 4]
call esi
push 1
push dword [ebp - 8]
push edi
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x41f76e
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push eax
push eax
push 0x12
call edi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
xor eax, eax
push eax
push eax
push eax
push 0x12
call edi
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, dword [ebp - 0xc]
test eax, eax
jne 0x41f76a
mov ebx, dword [ebp - 0x10]
push 0
push dword [ebp - 8]
push dword [ebp - 4]
call esi
push 0
push edi
push dword [ebp - 4]
call esi
push 0
push dword [ebp - 8]
push edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
inc eax
jmp 0x41f761
push 4
jmp 0x41f770
push 3
pop ebx
jmp 0x41f744
push 2
pop ebx
jmp 0x41f75e
push 9
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41f68a

Function at 0x4395cb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043944a

Function at 0x43d521
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043d1e1
Function at 0x460d65
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], ebx
mov edi, edx
mov dword [ebp - 0xc], ebx
call fcn.0040ae03
lea ecx, [ebp - 0x20]
call fcn.0040ae03
lea ecx, [ebp - 0x40]
call fcn.0040ae03
push 0x4c6930
lea ecx, [ebp - 0x30]
call fcn.00407467
push esi
lea ecx, [ebp - 0x30]
call fcn.004059dc
push str.CLSID
lea ecx, [ebp - 0x30]
call fcn.004059dc
lea ecx, [ebp - 0x20]
call fcn.0040abe7
test edi, edi
je 0x460de8
push 0x5c
pop eax
cmp word [edi], ax
je 0x460de8
cmp word [edi + 2], ax
je 0x460de8
push 0x4c6964
lea ecx, [ebp - 0x20]
call fcn.00407467
push edi
lea ecx, [ebp - 0x20]
call fcn.004059dc
cmp dword [ebp + 0xc], ebx
je 0x460e39
push 0x20
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.00422690
add esp, 0xc
mov dword [ebp - 0x5c], ebx
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x40]
push eax
call fcn.0040ad69
push str.IPC_
lea ecx, [ebp - 0x40]
call fcn.004059dc
mov eax, dword [ebp - 0x40]
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x60]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.MPR.dll_WNetAddConnection2W]
mov esi, eax
test esi, esi
js 0x460ec5
lea eax, [ebp - 0x10]
push eax
push reloc.WSOCK32.dll_bind
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, eax
test esi, esi
jne 0x460ec5
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x460ec0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x1fe
push eax
lea eax, [ebp - 0x26c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x460ebb
mov eax, dword [ebp - 8]
xor ecx, ecx
push dword [ebp + 8]
shr eax, 1
mov dword [ebp - 8], eax
mov word [ebp + eax*2 - 0x26c], cx
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov esi, eax
push dword [ebp - 0xc]
call edi
push dword [ebp - 0x10]
call edi
lea ecx, [ebp - 0x40]
call fcn.0040ac28
lea ecx, [ebp - 0x20]
call fcn.0040ac28
lea ecx, [ebp - 0x30]
call fcn.0040ac28
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4616f6
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, ecx
push edi
push esi
push 0
push dword [eax]
push 3
push ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edi, eax
test edi, edi
jne 0x46174e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x46174c
push dword [esi]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
je 0x46174c
push esi
push dword [esi]
push eax
push 3
push ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edi, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
pop ebp
ret
Function at 0x461bb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
test byte [ebp + 0x14], 1
mov eax, ebx
push edi
mov dword [ebp - 4], eax
mov edi, ebx
je 0x461bc8
inc edi
jmp 0x461bd1
test byte [ebp + 0x14], 2
je 0x461bd1
push 2
pop edi
test byte [ebp + 0x14], 4
je 0x461c10
push esi
lea eax, [ebp + 0x14]
mov dword [ebp + 0x14], ebx
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 1
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
push dword [ebp + 0x14]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
pop esi
je 0x461c3c
mov eax, dword [ebp - 4]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push eax
mov eax, dword [ebp + 0x20]
or eax, 0x400
push eax
push dword [ebp + 0x1c]
push ebx
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
setne bl
cmp dword [ebp - 4], 0
je 0x461c4b
push dword [ebp - 4]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
pop edi
mov al, bl
pop ebx
leave
ret 0x28

Function at 0x461d45
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov word [ebp - 0xc], 0x500
lea eax, [ebp - 8]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 4], eax
test eax, eax
je 0x461d9c
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 8]
neg eax
sbb eax, eax
and dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 4]
cmp eax, 1
pop ebx
sete al
leave
ret

Function at 0x461ee5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 0xc
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
push 2
push 0
push 0
push ebx
call edi
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 2
push 0
push 0
lea eax, [ebx + 8]
push eax
call edi
push eax
mov eax, dword [ebp + 0x10]
push dword [eax]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebx + 4], eax
xor eax, eax
push eax
push eax
push ebx
push 0x461f56
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x46220e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 4]
push eax
mov esi, ecx
lea eax, [ebp - 8]
push eax
push 0xb0
mov dword [ebp - 0x10], esi
push dword [esi]
call edi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jae 0x4622b1
xor ebx, ebx
push ebx
push ebx
push 0xe
push dword [esi]
call edi
mov edi, eax
test edi, edi
je 0x4622b1
cmp edi, dword [ebp - 8]
jb 0x4622b1
cmp edi, dword [ebp - 4]
jb 0x4622b1
xor ecx, ecx
lea esi, [edi + 1]
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042015b
pop ecx
push eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push esi
push 0xd
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [ebp - 0xc]
test eax, eax
je 0x4622a6
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x462295
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
lea eax, [esi + eax*2]
push eax
call fcn.00407467
mov bl, 1
push esi
call fcn.00420164
pop ecx
mov al, bl
jmp 0x4622b3
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x462c84
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov dl, 1
push esi
push edi
mov ecx, dword [ebx]
call fcn.00464128
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0x25
call edi
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
cmp dword [ebp + 8], 0
push eax
jge 0x462cda
push 0x25
push 0x100
push dword [ebx]
call esi
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
jmp 0x462cfe
push 0x27
push 0x100
push dword [ebx]
call esi
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push dword [ebx]
call esi
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebx]
xor dl, dl
call fcn.00464128
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4

Function at 0x463489
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
mov edi, ecx
cmp dl, 1
jne 0x4634b5
lea eax, [ebp - 4]
push eax
push 0x1388
push 2
push esi
push esi
push esi
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x4634cc
push 1
jmp 0x4634b6
push esi
push esi
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
leave
ret
Function at 0x4642af
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
call fcn.0040abe7
mov eax, dword [esi]
mov ecx, eax
mov dword [ebp - 8], eax
call fcn.004643ee
test al, al
je 0x4642d9
xor al, al
jmp 0x464369
mov ecx, esi
call fcn.00464370
mov ebx, eax
test ebx, ebx
jne 0x4642eb
mov ebx, 0x7fff
xor ecx, ecx
lea esi, [ebx + 1]
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042015b
pop ecx
mov edi, eax
push edi
push esi
push 0xd
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x464360
push edi
call fcn.004290d0
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x464357
xor ecx, ecx
test esi, esi
je 0x464339
mov al, byte [ecx + edi]
sub al, 0x20
cmp al, 0x5e
ja 0x464357
inc ecx
cmp ecx, esi
jb 0x46432b
push edi
lea ecx, [ebp - 0x18]
call fcn.004640d3
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.004076bb
lea ecx, [ebp - 0x18]
call fcn.0040ac28
jmp 0x464360
mov ecx, dword [ebp + 8]
push edi
call fcn.00407467
push edi
call fcn.00420164
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x469d32
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042015b
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.00421170
add dword [ebx], esi
xor eax, eax
mov ecx, dword [ebp + 8]
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x469d8d
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x469d84
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x46a33f
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [ecx + 0x20]
neg eax
sbb eax, eax
and eax, 2
cmp dword [ecx], eax
jl 0x46a34f
mov eax, dword [ecx]
mov ecx, eax
jmp fcn.0046b7a9

Function at 0x46a356
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [ecx + 0x20]
neg eax
sbb eax, eax
and eax, 2
cmp dword [ecx + 4], eax
jl 0x46a368
mov eax, dword [ecx + 4]
mov ecx, eax
jmp fcn.0046b7a9