joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f6ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004048b8
mov eax, dword [ebp - 8]
call fcn.004048b8
mov eax, dword [ebp - 0xc]
call fcn.004048b8
xor eax, eax
push ebp
push 0x42f8a5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x42f72d
push 0x42f8c0
push dword [ebp - 4]
push 0x42f8cc
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.00404788
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.00408174
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 8]
call fcn.00404484
lea eax, [ebp - 0x60]
mov edx, 0x44
call fcn.00406ee4
lea eax, [ebp - 0x1c]
mov edx, 0x10
call fcn.00406ee4
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
test ebx, ebx
je 0x42f780
mov word [ebp - 0x30], 5
push 0
push 0x10000000
push 0
push 0
push 0
mov eax, ebx
call fcn.004048c8
mov esi, eax
push esi
call sub.user32.dll_CreateDesktopA
mov dword [ebp - 0x58], esi
jmp 0x42f788
mov ax, word [ebp + 8]
mov word [ebp - 0x30], ax
cmp dword [ebp - 0xc], 0
jne 0x42f7fb
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004048c8
push eax
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x42f86a
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404714
mov eax, dword [ebp - 0x6c]
call fcn.004048c8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
jmp 0x42f86a
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004048c8
mov ebx, eax
push ebx
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004048c8
push eax
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x42f86a
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x70]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404714
mov eax, dword [ebp - 0x70]
call fcn.004048c8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov eax, dword [ebp - 0x1c]
mov ebx, eax
cmp byte [ebp + 0x10], 0
je 0x42f87d
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f8ac
lea eax, [ebp - 0x70]
mov edx, 4
call fcn.00404410
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404410
ret
Function at 0x42f9a0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
push ebx
xor ebx, ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
call fcn.00404f40
lea eax, [ebp - 0xc]
call fcn.00404f40
xor eax, eax
push ebp
push 0x42fb35
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0042f8d0
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x270]
mov ecx, 0x42fb48
mov edx, dword [ebp - 0x10]
call fcn.00404c98
mov eax, dword [ebp - 0x270]
call fcn.00404c1c
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x42fae3
xor eax, eax
push ebp
push 0x42fadc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x240]
mov ecx, 0x104
call fcn.00404bf0
mov eax, dword [ebp - 0x18]
mov edx, 0x42fb50
call fcn.00404d48
je 0x42fab1
mov eax, dword [ebp - 0x18]
mov edx, 0x42fb58
call fcn.00404d48
je 0x42fab1
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00404c98
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0042f914
test eax, eax
jle 0x42fab1
lea edx, [ebp - 0x274]
mov eax, dword [ebp - 0x14]
call fcn.00430e34
mov edx, dword [ebp - 0x274]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x26c]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x42fa47
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fae3
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_FindClose_1
ret
lea edx, [ebp - 0x278]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x278]
mov eax, dword [ebp + 8]
call fcn.00404c0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fb3c
lea eax, [ebp - 0x278]
mov edx, 2
call fcn.00404410
lea eax, [ebp - 0x270]
call fcn.00404a8c
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404aa4
ret
Function at 0x42fe04
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048b8
xor eax, eax
push ebp
push 0x42fec0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x42fea0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42fe96
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov dword [esi], eax
push 4
push 0x1000
mov eax, dword [esi]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42feaa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fec7
lea eax, [ebp - 4]
call fcn.004043ec
ret

Function at 0x42ffec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov eax, edi
call fcn.004056f0
mov esi, eax
push esi
mov eax, dword [ebp - 4]
mov ecx, 1
mov edx, dword [0x42ffc4]
call fcn.004058cc
add esp, 4
mov edx, esi
dec edx
test edx, edx
jl 0x430035
inc edx
xor eax, eax
mov ecx, esi
sub cl, al
xor cl, byte [edi + eax]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
mov byte [ebx + eax], cl
inc eax
dec edx
jne 0x430022
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4303c4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048b8
xor eax, eax
push ebp
push 0x430504
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.00407f4c
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 4]
call fcn.00404484
xor edx, edx
mov eax, 2
call fcn.0041aa94
mov esi, eax
mov dword [ebp - 0x134], 0x128
lea edx, [ebp - 0x134]
mov eax, esi
call fcn.0041aab4
mov edi, eax
jmp 0x4304c8
lea eax, [ebp - 0x140]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.0040465c
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.00408bd4
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0xc]
call fcn.00407f4c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404814
jne 0x4304b9
mov bl, 1
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [ebp - 0x12c]
je 0x4304b3
push 0
mov eax, dword [ebp - 0x12c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp byte [ebp - 5], 0
je 0x4304d0
lea edx, [ebp - 0x134]
mov eax, esi
call fcn.0041aad4
mov edi, eax
test edi, edi
jne 0x43044a
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43050b
lea eax, [ebp - 0x140]
mov edx, 3
call fcn.00404410
lea eax, [ebp - 0xc]
call fcn.004043ec
lea eax, [ebp - 4]
call fcn.004043ec
ret

Function at 0x430514
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov ebx, eax
test ebx, ebx
jbe 0x430539
call sub.kernel32.dll_GetCurrentProcessId
cmp ebx, eax
je 0x430539
push 0
push ebx
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4305a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048b8
xor eax, eax
push ebp
push 0x430624
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test esi, esi
je 0x43060e
push 0
push 0
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x43060e
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
push edi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
push edi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43062b
lea eax, [ebp - 4]
call fcn.004043ec
ret
Function at 0x4306b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebp, eax
mov eax, dword [esp]
call fcn.004046c8
mov edi, eax
mov eax, dword [esp]
call fcn.004046c8
mov esi, eax
test esi, esi
jle 0x4306ef
mov ebx, 1
mov eax, dword [esp]
movzx eax, byte [eax + ebx - 1]
xor edi, eax
inc ebx
dec esi
jne 0x4306e1
mov eax, dword [esp + 4]
mov edx, ebp
call fcn.00404440
mov eax, ebp
call fcn.004046c8
mov esi, eax
test esi, esi
jle 0x430725
mov ebx, 1
mov eax, dword [esp + 4]
call fcn.00404920
mov edx, edi
xor dl, byte [ebp + ebx - 1]
not dl
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x43070c
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430804
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.004043ec
mov eax, esp
mov edx, 2
call fcn.00406ee4
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.004048c8
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x430855
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.004044dc
jmp 0x43086e
mov edx, ebx
dec edx
mov eax, esi
call fcn.004049f8
push ebx
mov eax, dword [esi]
call fcn.004048c8
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430ffc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebp, ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
mov dword [esp + 8], 4
push esp
push 0x20119
push 0
mov eax, edi
call fcn.004048c8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x43105f
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
push 0
mov eax, ebp
call fcn.004048c8
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x43105f
cmp dword [esp + 0xc], 4
jne 0x43105f
mov ebx, dword [esp + 4]
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x431074
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.004043ec
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 0xc]
call fcn.00406ee4
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
mov eax, edi
call fcn.004048c8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x431102
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x431102
cmp dword [ebp - 0x10], 1
jne 0x431102
mov eax, ebx
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.0040465c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43265c
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x432784
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
lea eax, [esp + 4]
mov edx, 0x101
call fcn.00406ee4
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4327be
mov edx, dword [esp]
dec edx
mov eax, ebx
call fcn.004049f8
jmp 0x4327c5
mov eax, ebx
call fcn.004043ec
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.0040465c
add esp, 0x108
pop ebx
ret

Function at 0x4327e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43285c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x26]
xor ecx, ecx
mov edx, 0x22
call fcn.004030cc
mov dword [ebp - 4], 0x11
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x26]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x43283f
lea eax, [ebp - 0x2c]
lea edx, [ebp - 0x26]
mov ecx, 0x11
call fcn.00404bf0
mov eax, dword [ebp - 0x2c]
mov edx, ebx
call fcn.00430e34
jmp 0x432846
mov eax, ebx
call fcn.004043ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432863
lea eax, [ebp - 0x2c]
call fcn.00404a8c
ret
Function at 0x432b4c
Capabilities:
Enumerate pe sections
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
xor edx, edx
mov dword [esp], edx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x432b87
push 0
push 0x432c80
push 0x432c84
push 0
call sub.user32.dll_MessageBoxA_1
push 0
push ebp
call sub.kernel32.dll_GetFileSize
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
call fcn.00402a18
mov ebx, eax
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
push ebx
push ebp
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x432bc8
push 0
push 0x432c80
push 0x432c88
push 0
call sub.user32.dll_MessageBoxA_1
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x3c]
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x50]
call fcn.00402a18
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x50]
mov eax, dword [esp]
call fcn.00406ee4
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x54]
mov edx, ebx
mov eax, dword [esp]
call fcn.00406edc
mov eax, dword [esp + 0x10]
mov si, word [eax + 6]
dec esi
test si, si
jb 0x432c61
inc esi
xor edi, edi
mov edx, dword [esp + 0xc]
mov edx, dword [edx + 0x3c]
mov eax, ebx
add edx, eax
add edx, 0xf8
movzx ecx, di
shl ecx, 3
lea ecx, [ecx + ecx*4]
add edx, ecx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x14]
mov ecx, dword [edx + 0x10]
mov edx, dword [esp + 0x14]
mov edx, dword [edx + 0x14]
add edx, eax
push edx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0xc]
add eax, dword [esp + 4]
pop edx
call fcn.00406edc
inc edi
dec si
jne 0x432c19
mov edx, dword [esp + 4]
mov eax, ebx
call fcn.00402a48
push ebp
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp]
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x432cf8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov dword [esp], edx
mov esi, eax
xor eax, eax
mov dword [esp + 4], eax
mov edx, dword [esi + 0x3c]
mov eax, esi
add edx, eax
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
add edx, 0x78
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
mov edx, dword [edx]
add edx, eax
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x1c]
add edx, eax
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x20]
add edx, eax
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x24]
add edx, eax
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov ebx, dword [eax + 0x18]
dec ebx
test ebx, ebx
jb 0x432de2
inc ebx
mov eax, dword [esp + 0x20]
movzx edx, word [eax]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
cmp edx, eax
jbe 0x432d85
add dword [esp + 0x18], 4
inc eax
cmp edx, eax
ja 0x432d7b
mov edx, dword [esp + 0xc]
mov edx, dword [edx]
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
cmp edx, eax
ja 0x432da0
mov ecx, dword [esp + 0xc]
add edx, dword [ecx + 4]
cmp eax, edx
jb 0x432dd5
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
add eax, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
call fcn.00432a38
mov ecx, eax
mov edx, dword [esp + 0x24]
xor eax, eax
call fcn.00432a4c
cmp eax, dword [esp]
jne 0x432dd5
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
add eax, esi
mov dword [esp + 4], eax
jmp 0x432de2
add dword [esp + 0x20], 2
add dword [esp + 0x1c], 4
dec ebx
jne 0x432d66
mov eax, dword [esp + 4]
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x433bd4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004048c8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x433bed
test al, 0x10
je 0x433bf1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x433bf8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404c1c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x433c11
test al, 0x10
je 0x433c15
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x434bb4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
cmp byte [0x461cf8], 0
je 0x434be4
mov edx, 0xc8
mov eax, 0x32
call fcn.0041af8c
push eax
call sub.kernel32.dll_Sleep
cmp bl, 0x90
jne 0x434c27
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp al, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
test bl, bl
je 0x434c12
and byte [ebp - 0x72], 0xfe
jmp 0x434c16
or byte [ebp - 0x72], 1
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_SetKeyboardState
jmp 0x434cad
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov byte [ebp - 2], al
test si, si
jbe 0x434cad
mov eax, ebx
and eax, 0xff
bt dword [0x45f4f4], eax
jae 0x434c7d
mov eax, dword [ebp + 8]
push eax
mov ecx, 1
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00434b68
pop ecx
cmp byte [ebp - 1], 0
je 0x434ca8
mov eax, dword [ebp + 8]
push eax
mov ecx, 3
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00434b68
pop ecx
jmp 0x434ca8
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00434b68
pop ecx
cmp byte [ebp - 1], 0
je 0x434ca8
mov eax, dword [ebp + 8]
push eax
mov ecx, 2
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00434b68
pop ecx
dec si
jne 0x434c3d
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x434cb4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
cmp byte [0x461cf8], 0
je 0x434cd8
mov edx, 0xc8
mov eax, 0x32
call fcn.0041af8c
push eax
call sub.kernel32.dll_Sleep
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
and edx, 0xff
bt dword [0x45f4f4], edx
jae 0x434d0a
mov edx, dword [ebp + 8]
push edx
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.00434b68
pop ecx
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.00434b68
pop ecx
pop ebx
pop ebp
ret
Function at 0x436278
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x43627e
ret

Function at 0x438268
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4382b9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4382a0
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x438290
jmp 0x4382b9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4382a1
pop ebx
mov esp, ebp
pop ebp
ret