joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5049d1
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x1621193f
pushfd
and ecx, 0xa1ac063e
push esi
mov esi, ecx
lea esi, [esi + esi*4 - 0x1fe716df]
mov dword [esp + 0x10], 0x6442d9b
mov esi, dword [esp + ecx - 0x20003e]
sub cl, 0xbc
neg cx
xor cx, 0xae95
sub cl, 0x9d
lea ecx, [ecx + ecx*2 - 0x23e42862]
sub cx, 0xc921
mov ecx, dword [esp + 0xc]
jl 0x5049ea
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.00467bbd
call fcn.004181d9
xchg ecx, ebx
imul edx, esp, 0xffffff9a
mov word [edx], fs
lodsd eax, dword [esi]
int1
adc eax, 0x2d9cf74e
cmp byte [edx + ebx*4 + 0x17b35cc3], dl
and ch, byte [ebp - 0x8b1ea0f]
pushfd
sub eax, 0xc39a9438
pop esp
mov bl, 0x17
jg 0x504a8b
or eax, 0x21fe2ee4
pop ecx
lcall 0x3d0e, 0x93503a43
dec ecx
out 0xe1, al
cmpsb byte [esi], byte es:[edi]
cmp al, 0xe7
mov ecx, 0x5a243efd
jp 0x504a86
mov bl, 0x48
ret
push ss
jmp 0x504a27
dec esp
hlt

Function at 0x632a2b
Capabilities:
Encode data using xor

Disassembly:
inc ebx
pop ebx
test dword [ebx], esp
xor al, 0x13
insb byte es:[edi], dx
in al, dx
xchg edi, eax
mov ch, 0xad
aas
jns 0x632a05
leave
loop 0x632a21
mov dh, 0xb1
test eax, 0xd636d6cd
nop
lahf
aaa
cmp dword [edi + 2], ebx
out 0xa4, al
and ah, byte [ebx]
add di, cx
push 0xca87b895
call fcn.0044a948
arpl word [ebp - 0x17fbdb9c], cx
daa
invalid
xor bl, al
call fcn.00508966
cmovge ebp, dword [ecx + edx*4 - 0x74cc520]
loopne 0x632a73
mov bl, 0xf8
inc ecx
js 0x6329eb
lahf
mov dword [0x71bc6667], eax
and ah, byte [edi - 0x73c1e86a]
mov esi, 0x256d0395
jecxz 0x632aa2
sti
dec ecx
push ebx
xor eax, 0xa5a7f038
leave
push esi
mov ah, 0xe0
movsb byte es:[edi], byte [esi]
inc ebx
cmpsd dword [esi], dword es:[edi]
stc
mov dword [0xda90a466], eax
das
nop
fisubr dword [edi]
stc
inc edx
fdivrp st(0)
pop eax
push ss
neg byte [edx + 0x5d5e7ddd]
out dx, al
push eax
and byte [ebp + 0xa8b7316], 0x51
in al, 0xba
cmp eax, dword [ebx]
pop ss
pop edi
sub edi, dword [esp + ecx*2 - 0x4d]
mov byte ss:[ebx], dh
enter 0x535c, 0xffffffffffffffe4
fidiv dword [ebp + esi*2 - 0x3c]
jg 0x632a37
pop eax
jne 0x632a64
jns fcn.00632a2b
mov al, byte [0x9182b25b]
neg dword [ecx]
mov dword [edi + 0x5f], ecx
aad 0xa2
int 0x15
lds si, [esi - 0x253316a9]
fiadd word cs:[ebx - 0x67]
mov dword [ecx - 0x55d4e87a], ecx
clc
outsb dx, byte [esi]
mov edx, 0x53171c9e
in al, 0xfa
adc byte [eax + ebx*2 - 0xba8b381], ah
jb 0x632a65
retf
Function at 0x40e9fc
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1014]
mov eax, 0x1014
call fcn.0042cab0
push 0xffffffffffffffff
push 0x42e670
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x43e040]
xor eax, ebp
mov dword [ebp + 0x1010], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
call fcn.0040295b
push 0xfff
lea eax, [ebp + 1]
push ebx
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp], bl
call fcn.0041dd90
mov esi, dword [0x431054]
add esp, 0xc
push 0xf0000000
push edi
mov edi, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push edi
push ebx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
jne 0x40ea9c
push ebx
push 1
push edi
push ebx
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x40eb9c
cmp dword [ebp + 0x1034], 8
mov eax, dword [ebp + 0x1020]
jae 0x40eab1
lea eax, [ebp + 0x1020]
push 0x437598
push eax
call fcn.0041ecad
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x40eb92
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0x10]
call dword [0x43104c]
mov dword [ebp - 0x18], 0x100
mov esi, 0x1000
jmp 0x40eb14
push esi
lea eax, [ebp]
push ebx
push eax
call fcn.0041dd90
push edi
push esi
lea eax, [ebp]
push 1
push eax
call fcn.0041ef64
add esp, 0x1c
push ebx
push eax
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [0x431044]
push edi
call fcn.0041eb69
pop ecx
test eax, eax
je 0x40eaea
dec dword [ebp - 0x18]
jne 0x40eb14
push edi
call fcn.0041f15c
xor eax, eax
mov byte [ebp + 0x1000], bl
lea edi, [ebp + 0x1001]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
push ebx
stosb byte es:[edi], al
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x1000]
push eax
push 2
push dword [ebp - 0x14]
mov dword [ebp - 0x24], 0x10
call dword [0x431058]
push dword [ebp - 0x14]
call dword [0x431048]
lea ebx, [ebp + 0x1000]
lea ecx, [ebp - 0x40]
call fcn.004013f3
push 0xffffffffffffffff
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
push 0
call fcn.00402be0
push 0
push 1
lea esi, [ebp - 0x40]
call fcn.00402d55
xor ebx, ebx
push ebx
push dword [ebp - 0x10]
call dword [0x431050]
push ebx
push 1
lea esi, [ebp + 0x101c]
call fcn.00402d55
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1010]
xor ecx, ebp
call fcn.0041c82b
add ebp, 0x1014
leave
ret
Function at 0x41b722
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x43e040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x24], eax
cmp word [edi], si
jne 0x41b74d
mov eax, 0x80070057
jmp 0x41b903
push esi
push esi
push esi
push 1
push esi
call dword [0x431480]
mov dword [ebp - 0x2c], eax
cmp eax, esi
jne 0x41b76a
call fcn.00406728
jmp 0x41b903
push ebx
push 4
lea ecx, [ebp - 0x38]
push ecx
push 6
push eax
mov dword [ebp - 0x38], 0x7530
call dword [0x431490]
mov ebx, dword [0x431484]
test eax, eax
jne 0x41b79e
call fcn.00406728
mov esi, eax
push dword [ebp - 0x2c]
call ebx
mov eax, esi
jmp 0x41b902
push esi
push SysReAllocString
push esi
push esi
push edi
push dword [ebp - 0x2c]
call dword [0x4314a0]
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x41b78b
xor eax, eax
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x13
push dword [ebp - 0x1c]
mov dword [ebp - 0x34], 0x14
call dword [0x43148c]
lea eax, [ebp - 0x18]
push eax
call fcn.0041cf25
pop ecx
cmp eax, 0xc8
je 0x41b7fe
push dword [ebp - 0x1c]
call ebx
mov esi, 0x194
jmp 0x41b792
push 0x43fb80
mov edi, 0x10000
push edi
call fcn.0041f518
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
cmp eax, esi
jne 0x41b826
push dword [ebp - 0x1c]
call ebx
mov esi, 0x8007000e
jmp 0x41b792
push edi
push esi
push eax
call fcn.0041dd90
add esp, 0xc
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push dword [ebp - 0x24]
call dword [0x431280]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
jne 0x41b887
call fcn.00406728
mov esi, eax
push dword [ebp - 0x20]
call fcn.0041d460
pop ecx
push dword [ebp - 0x1c]
call ebx
jmp 0x41b792
cmp dword [ebp - 0x28], esi
je 0x41b8b1
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0x30], esi
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [0x431268]
test eax, eax
je 0x41b8d7
lea eax, [ebp - 0x28]
push eax
push edi
push dword [ebp - 0x20]
mov dword [ebp - 0x28], esi
push dword [ebp - 0x1c]
call dword [0x43149c]
test eax, eax
jne 0x41b867
call fcn.00406728
push dword [ebp - 0x24]
mov esi, eax
call dword [0x431284]
jmp 0x41b854
push dword [ebp - 0x24]
call dword [0x431284]
push dword [ebp - 0x20]
call fcn.0041d460
mov esi, dword [0x431484]
pop ecx
push dword [ebp - 0x1c]
call esi
push dword [ebp - 0x2c]
call esi
xor eax, eax
jmp 0x41b902
call fcn.00406728
push dword [ebp - 0x24]
mov edi, eax
call dword [0x431284]
push dword [ebp - 0x20]
call fcn.0041d460
mov esi, dword [0x431484]
pop ecx
push dword [ebp - 0x1c]
call esi
push dword [ebp - 0x2c]
call esi
mov eax, edi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041c82b
leave
ret 4
Function at 0x402f74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x478020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40300c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402fec
xor eax, eax
push ebp
push 0x402fe5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403028
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402fec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x478020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x478020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403cd0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47b048], 0
je 0x403d31
cmp word [0x47b21c], 0xd7b2
jne 0x403cf9
cmp dword [0x47b224], 0
jbe 0x403cf9
mov eax, 0x47b218
call dword [0x47b234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47806c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403d58
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x478030], 0
jne 0x403d4d
push 0
push 0x478064
push 0x47806c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405a00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a66
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004040bc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405a50
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a6d
lea eax, [ebp - 0x10]
call fcn.00403e4c
ret

Function at 0x40ad90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40adc9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f3c
jmp 0x40add2
mov eax, ebx
mov edx, esi
call fcn.00403ea0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40addc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40adfd
mov al, byte [esp]
jmp 0x40adff
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bdc0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40be96
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403ee4
lea eax, [ebp - 8]
call fcn.0040435c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040430c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40be80
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40be79
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040430c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40be63
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40bea8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40be63
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40be80
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40be9d
lea eax, [ebp - 8]
call fcn.00403e4c
ret
Function at 0x40c3a8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c40c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004040bc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407f64
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c413
lea eax, [ebp - 0xc]
call fcn.00403e4c
ret

Function at 0x41a820
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x47b884
cmp dword [edi], 0
jne 0x41a89c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x47b880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x47846c
mov ecx, 2
call fcn.004028b8
mov edx, 0x41a7f8
lea eax, [esi + 5]
call fcn.0041a818
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a818
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a871
mov dword [0x47b880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41be10
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41be16
ret

Function at 0x41e3b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41e401
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41e3e8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41e3d8
jmp 0x41e401
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41e3e9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426ee8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004042fc
xor eax, eax
push ebp
push 0x427016
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x426fe9
xor eax, eax
push ebp
push 0x426fe2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040410c
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x426fb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x426fa6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040410c
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.0040430c
mov edx, ebx
pop ecx
call fcn.004028b8
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426fad
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x47a834]
mov dl, 1
mov eax, dword [0x406de8]
call fcn.0040b62c
call fcn.00403888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42701d
lea eax, [ebp - 4]
call fcn.00403e4c
ret
Function at 0x427024
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4271d5
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.004044fc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4271ec
call fcn.00404158
mov eax, ebx
call fcn.00419db4
mov edi, eax
dec edi
test edi, edi
jl 0x4270dc
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00419d88
mov edx, dword [0x42d224]
call fcn.00403288
test al, al
je 0x4270d8
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00419d88
lea edx, [ebp - 0x14]
call fcn.00435050
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.004044fc
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004041cc
inc esi
dec edi
jne 0x42708a
mov al, byte [0x4271f0]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x4271fc
mov eax, dword [ebp - 0xc]
call fcn.0040c980
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00403ee4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00435050
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x4271ec
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00435050
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x4271ec
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x4271ec
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x427208
call fcn.00408b90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4271dc
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00403e70
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00403e70
lea eax, [ebp - 0x14]
call fcn.00403e4c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403e70
ret
Function at 0x42aee0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0042ab44
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040430c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x42af3e
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x47a9fc]
mov dl, 1
mov eax, dword [0x42aa3c]
call fcn.0040b668
call fcn.00403888
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42af48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040430c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x42afa0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x47abe0]
mov dl, 1
mov eax, dword [0x42aa3c]
call fcn.0040b668
call fcn.00403888
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042ab74
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42fa38
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x42f984
call sub.user32.dll_EnumWindows
ret

Function at 0x42fb58
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x42fbd5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0042f5b8
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x42fb7d
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0042f1b8
cmp dword [ebp - 4], 0
je 0x42fbbf
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.0040430c
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fbdc
lea eax, [ebp - 4]
call fcn.00403e4c
ret
Function at 0x432ba0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x47bb80], 0
je 0x432cef
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x47aa70]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x432cef
mov eax, dword [0x47bb84]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x47bb80]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x432cbe
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x47bb80]
call fcn.00413c50
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x432cb6
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x432cb6
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x432cb6
mov eax, dword [ebp - 0x14]
call fcn.0043b82c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x432cb6
push ebp
call fcn.00432b5c
pop ecx
test al, al
jne 0x432cb6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x432c72
mov eax, dword [ebp - 0x14]
call fcn.0043a35c
dec eax
jle 0x432cb6
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004032f8
cmp byte [ebp - 1], 0
je 0x432cb6
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x432cb6
mov edx, dword [ebp - 0x14]
mov eax, dword [0x47bb84]
call fcn.00432328
inc edi
dec ebx
jne 0x432c05
mov eax, dword [0x47bb84]
cmp dword [eax + 8], 0
jle 0x432cd6
mov eax, dword [0x47bb84]
call fcn.004323b8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x432cef
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004329c4
pop ecx
test al, al
jne 0x432cef
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret