joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421c70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00417fea
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x421ca8
xor eax, eax
jmp 0x421cd4
cmp esi, dword [ebp - 4]
je 0x421cd1
cmp dword [ebp + 0xc], 0
je 0x421cd1
push dword [edi + 0x9c]
call fcn.0042187e
push dword [edi + 0x9c]
mov esi, eax
call fcn.004126f6
pop ecx
pop ecx
cmp esi, eax
je 0x421ca4
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x401a20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov dword [edi], 0
xor esi, esi
push esi
call ebx
test ax, ax
jge 0x401a4d
push ebp
push esi
call fcn.00401000
add esp, 8
test eax, eax
je 0x401a4d
mov dword [edi], esi
inc esi
cmp esi, 0xff
jbe 0x401a35
pop esi
pop ebp
pop ebx
ret

Function at 0x402510
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x34
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push ebp
mov ebp, dword [esp + 0x40]
push esi
push edi
xor esi, esi
push esi
push esi
push 0x1004
push ebp
call ebx
test eax, eax
jle 0x4025cd
xor eax, eax
mov ecx, 0xd
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push 0
push 0x1005
push ebp
mov dword [esp + 0x20], 4
mov dword [esp + 0x24], esi
call ebx
test eax, eax
je 0x40258f
mov ecx, dword [esp + 0x30]
movsx edx, byte [esp + 0x4c]
shr ecx, 0x10
cmp ecx, edx
je 0x402599
push 0
push 0
push 0x1004
push ebp
inc esi
call ebx
cmp esi, eax
jl 0x402535
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x34
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x34
ret
xor eax, eax
mov ecx, 0xd
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, 3
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
push esi
push 0x102b
push ebp
mov dword [esp + 0x20], 8
mov dword [esp + 0x24], esi
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x34
ret
Function at 0x4025e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe4
mov eax, dword [0x4527b8]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x41
mov dword [esp + 0xf0], eax
lea eax, [esp + 0x14]
push eax
push ecx
push edi
mov ebx, edx
mov dword [esp + 0x1c], 1
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
push eax
call esi
mov eax, dword [0x45a368]
cmp eax, 1
jne 0x40262f
mov dword [ebp + 0x18], ebx
jmp 0x402638
test eax, eax
jle 0x40265d
cmp eax, 3
jg 0x40265d
mov ecx, 0x10
lea esi, [esp + 0x10]
lea edi, [esp + 0x58]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x10
lea esi, [esp + 0x10]
lea edi, [esp + 0xa0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40268a
mov eax, dword [ebp + 0x10]
push 0x41
lea edx, [esp + 0x5c]
push edx
push eax
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call esi
mov edx, dword [ebp + 0x14]
push 0x41
lea ecx, [esp + 0xa4]
push ecx
push edx
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call esi
xor edi, edi
cmp ebx, edi
jne 0x4026a5
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402697
sub eax, edx
cmp eax, 1
jb 0x4026fe
lea esi, [esp + 0xa0]
lea eax, [esp + 0x58]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4026d8
test cl, cl
je 0x4026d4
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4026d8
add eax, 2
add esi, 2
test cl, cl
jne 0x4026b0
xor eax, eax
jmp 0x4026dd
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4026fe
cmp dword [ebp + 0x18], edi
jne 0x402702
lea eax, [esp + 0x58]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4026f0
sub eax, edx
cmp eax, 1
jae 0x402702
mov dword [esp + 0xc], edi
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edx, dword [ebp + 8]
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0xa0]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xc]
stosb byte es:[edi], al
mov eax, dword [esp + 0xc]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [esp + 0xec]
call fcn.0041d4a3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404200
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x34
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
mov esi, dword [esp + 0x40]
push edi
push 0
push 0
push 0x1042
push esi
call ebx
mov edx, eax
mov eax, dword [0x450060]
test eax, eax
jl 0x404229
mov edx, eax
xor eax, eax
mov ecx, 0xd
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x1005
push esi
mov dword [esp + 0x1c], 4
mov dword [esp + 0x20], edx
call ebx
test eax, eax
pop edi
pop esi
pop ebx
jne 0x40425f
or eax, 0xffffffff
add esp, 0x34
ret
mov eax, dword [esp + 0x20]
add esp, 0x34
ret
Function at 0x404270
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x34
mov edx, dword [esp + 0x38]
push edi
xor eax, eax
mov ecx, 0xd
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x40]
lea ecx, [esp + 4]
push ecx
push 0
push 0x1005
push edx
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
pop edi
jne 0x4042b4
or eax, 0xffffffff
add esp, 0x34
ret
mov eax, dword [esp + 0x20]
add esp, 0x34
ret

Function at 0x4042c0
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x105
push 0x46c8a0
mov esi, eax
push 0x409
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x46c8a0
call fcn.00410180
add esp, 4
test eax, eax
je 0x404313
cmp dword [0x45a368], 1
mov eax, str.MOUNTED_NO_PKCS5_PRF_CHANGE
je 0x404307
mov eax, str.MOUNTED_NOPWCHANGE
push eax
call fcn.00410a40
add esp, 4
pop edi
pop esi
ret
mov eax, dword [0x466ba0]
push 0
push 0x402760
push esi
push 0x66
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 1
jne 0x40438b
push 0x40a
push esi
call edi
mov esi, eax
mov eax, dword [0x45a368]
cmp eax, 1
je 0x404377
jle 0x404360
cmp eax, 3
jg 0x404360
push str.KEYFILE_CHANGED
call fcn.00410a00
add esp, 4
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
ret
push str.PASSWORD_CHANGED
call fcn.00410a00
add esp, 4
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
ret
push str.PKCS5_PRF_CHANGED
call fcn.00410a00
add esp, 4
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
ret
Function at 0x4050a0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x9c
mov eax, dword [0x4527b8]
mov dword [esp + 0x98], eax
mov eax, dword [0x45a360]
test eax, eax
je 0x4050d3
mov eax, 1
mov ecx, dword [esp + 0x98]
call fcn.0041d4a3
add esp, 0x9c
ret
push str.TrueCryptTaskBarIcon
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [0x45a360], eax
je 0x4051a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4051a4
mov eax, dword [esp + 0xa0]
mov edx, dword [0x466b84]
xor ecx, ecx
mov dword [esp + 4], eax
mov eax, 7
cmp edx, eax
mov edx, dword [0x466ba0]
setne cl
push esi
mov dword [esp + 4], 0x98
mov dword [esp + 0xc], 0x1f5
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x8007
dec ecx
and ecx, 0x80
push ecx
push 0x10
push 0x10
push 1
push 0x1f5
push edx
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push 0x43f140
push eax
call fcn.0041d456
add esp, 8
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov esi, eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40518e
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, esi
pop esi
mov ecx, dword [esp + 0x98]
call fcn.0041d4a3
add esp, 0x9c
ret
mov ecx, dword [esp + 0x98]
mov dword [0x45a360], 0
xor eax, eax
call fcn.0041d4a3
add esp, 0x9c
ret
Function at 0x407f60
Capabilities:
Get disk information

Disassembly:
mov eax, 0x3674
call fcn.0041ddb0
push esi
lea eax, [esp + 4]
push edi
push eax
call fcn.00410900
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
cmp dword [0x459f10], eax
jne 0x407fa9
mov ecx, 0xd9d
lea edi, [esp + 8]
mov esi, 0x456898
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x407fa9
pop edi
mov eax, 1
pop esi
add esp, 0x3674
ret
mov ecx, 0xd9d
lea esi, [esp + 8]
mov edi, 0x456898
rep movsd dword es:[edi], dword [esi]
call fcn.0040e410
mov eax, dword [0x466b74]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x3ef
push eax
call esi
push eax
call fcn.00405bb0
mov eax, dword [0x450060]
add esp, 8
test eax, eax
jl 0x408018
mov ecx, dword [0x466b74]
push eax
push 0x3ef
push ecx
call esi
push eax
call fcn.00404270
mov edx, dword [0x466b74]
add esp, 8
shr eax, 0x10
push eax
push 0x3ef
push edx
call esi
push eax
call fcn.00402510
add esp, 8
call fcn.0040e3e0
pop edi
xor eax, eax
pop esi
add esp, 0x3674
ret

Function at 0x408090
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [0x466b80]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0x409
push esi
call edi
push eax
call fcn.0040b300
mov eax, dword [0x450058]
add esp, 8
test eax, eax
je 0x4080c6
push esi
call fcn.00405870
add esp, 4
mov eax, dword [0x45a31c]
test eax, eax
je 0x4080f0
mov edx, dword [0x4506d8]
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0
push 0
push 0x72010
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [0x466b80]
test eax, eax
jne 0x40811e
push 0x43e976
push 0x409
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x409
push esi
call edi
push eax
call fcn.0040b7d0
add esp, 4
mov eax, dword [0x45a360]
test eax, eax
je 0x40813e
push 0
push esi
mov dword [0x45a364], 1
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ecx
ret
push esi
call fcn.004051d0
add esp, 4
push 0
push esi
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
pop esi
pop ecx
ret
Function at 0x40b300
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x4527b8]
push ebx
mov dword [esp + 0x114], eax
push esi
push edi
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
test eax, eax
push 0x104
jne 0x40b37c
mov esi, dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0
push 0x14b
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
xor eax, eax
mov ecx, dword [esp + 0x11c]
call fcn.0041d4a3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 8]
lea edx, [esp + 0x14]
push edx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b392
sub eax, edx
mov dword [esp + 0xc], eax
je 0x40b427
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x10]
push eax
push 0xffffffffffffffff
push 0x158
push edi
call ebx
push 0
mov esi, eax
call fcn.0041e16f
add esp, 4
cmp esi, 0xffffffff
jne 0x40b408
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x143
push edi
mov dword [esp + 0x1c], eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x40b412
mov edx, dword [esp + 0xc]
push edx
push esi
push 0x151
push edi
call ebx
mov eax, esi
mov ecx, dword [esp + 0x11c]
call fcn.0041d4a3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push esi
push 0x151
push edi
call ebx
mov eax, esi
mov ecx, dword [esp + 0x11c]
call fcn.0041d4a3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x147
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x11c]
call fcn.0041d4a3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b670
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
mov eax, dword [0x4527b8]
push ebx
mov dword [esp + 0x16c], eax
mov eax, dword [ebp + 0xc]
test eax, eax
push esi
push edi
je 0x40b6b9
push str.History.xml
call fcn.00413ac0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x174]
call fcn.0041d4a3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x43ee44
push str.History.xml
call fcn.00413ac0
add esp, 4
push eax
call fcn.0041d61e
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 0x14], esi
je 0x40b7af
push esi
call fcn.0041d280
push esi
push str._n_t_history_
call fcn.0041dd39
mov ebx, dword [ebp + 8]
add esp, 0xc
xor esi, esi
jmp 0x40b700
push esi
lea eax, [esp + 0x1c]
push eax
push ebx
call fcn.0040b450
add esp, 0xc
mov dword [esp + esi*4 + 0x18], eax
inc esi
cmp esi, 0x14
jl 0x40b700
mov dword [esp + 0x10], 0
mov byte [esp + 0x68], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x69]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + ecx*4 + 0x18]
push 0
stosw word es:[edi], ax
push esi
push 0x149
stosb byte es:[edi], al
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
call edi
cmp eax, 0x104
jae 0x40b764
lea edx, [esp + 0x68]
push edx
push esi
push 0x148
push ebx
call edi
mov al, byte [esp + 0x68]
test al, al
je 0x40b783
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x68]
push eax
push str._n_t_t_volume__s__volume_
push ecx
call fcn.0041d564
add esp, 0xc
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x14
mov dword [esp + 0x10], eax
jl 0x40b721
mov esi, dword [esp + 0x14]
push esi
push str._n_t__history_
call fcn.0041dd39
push esi
call fcn.0041d2a0
push esi
call fcn.0041d513
add esp, 0x10
mov ecx, dword [esp + 0x174]
call fcn.0041d4a3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b820
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
test esi, esi
je 0x40b84e
mov ecx, dword [esp + 8]
push edi
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
mov edi, dword [edx*4 + 0x450068]
shr eax, 8
xor eax, edi
inc ecx
dec esi
jne 0x40b831
pop edi
not eax
pop esi
ret
Function at 0x40b8d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
or eax, 0xffffffff
xor ecx, ecx
push edi
jmp 0x40b8e0
xor edx, edx
mov dl, byte [ecx + 0x450068]
add ecx, 4
xor edx, eax
and edx, 0xff
mov edi, dword [edx*4 + 0x450068]
xor edx, edx
mov dl, byte [ecx + 0x450065]
shr eax, 8
xor eax, edi
xor edx, eax
and edx, 0xff
mov edi, dword [edx*4 + 0x450068]
xor edx, edx
mov dl, byte [ecx + 0x450066]
shr eax, 8
xor eax, edi
xor edx, eax
and edx, 0xff
mov edi, dword [edx*4 + 0x450068]
xor edx, edx
mov dl, byte [ecx + 0x450067]
shr eax, 8
xor eax, edi
xor edx, eax
and edx, 0xff
mov edi, dword [edx*4 + 0x450068]
shr eax, 8
xor eax, edi
cmp ecx, 0x400
jl 0x40b8e0
not eax
sub eax, 0x6fcf9e13
neg eax
sbb eax, eax
inc eax
mov edi, eax
mov ecx, 0x450068
or eax, 0xffffffff
mov esi, 0x400
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
mov ebx, dword [edx*4 + 0x450068]
shr eax, 8
xor eax, ebx
inc ecx
dec esi
jne 0x40b976
not eax
sub eax, 0x6fcf9e13
neg eax
sbb eax, eax
inc eax
and eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x40dfb0
Capabilities:
Terminate process

Disassembly:
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
mov eax, dword [0x466b78]
mov ecx, dword [esp + 4]
push 0x10
push eax
push ecx
call fcn.00417ce0
add esp, 4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call fcn.0041d8c5
int3

Function at 0x40e650
Capabilities:
Get disk information
Get graphical window text

Disassembly:
sub esp, 0x13c
mov eax, dword [0x4527b8]
push ebp
push esi
mov esi, dword [esp + 0x148]
push edi
mov dword [esp + 0x144], eax
xor eax, eax
push eax
push eax
mov ecx, 0xd
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x1004
push esi
mov dword [esp + 0x1c], 1
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
inc eax
mov dword [esp + 0x10], eax
push 0x104
lea eax, [esp + 0x44]
push eax
push 0x43f3d4
call ebp
test eax, eax
je 0x40e6eb
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x1007
push esi
mov dword [esp + 0x30], str.DeviceFloppy0
call edi
lea edx, [esp + 0xc]
push edx
push 0
push 0x1006
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 0x43f3d4
call edi
push 0x104
lea eax, [esp + 0x44]
push eax
push 0x43f3d0
call ebp
test eax, eax
je 0x40e753
push 0
push 0
push 0x1004
push esi
mov dword [esp + 0x30], str.DeviceFloppy1
mov dword [esp + 0x24], 0
call edi
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x1007
inc eax
push esi
mov dword [esp + 0x20], eax
call edi
lea edx, [esp + 0xc]
push edx
push 0
push 0x1006
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 0x43f3d0
call edi
push 0
push 0
push 0x1004
push esi
call edi
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
pop edi
pop esi
pop ebp
dec ecx
and eax, ecx
mov ecx, dword [esp + 0x138]
call fcn.0041d4a3
add esp, 0x13c
ret

Function at 0x40eb20
Capabilities:
Create process on windows
Get file system object information

Disassembly:
sub esp, 0x16c
mov eax, dword [0x4527b8]
mov dword [esp + 0x168], eax
movsx eax, byte [esp + 0x170]
add eax, 0x41
push eax
lea ecx, [esp + 4]
push str._c:_
push ecx
call fcn.0041d3d4
add esp, 0xc
push 0
push 0x160
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push 1
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0x43ed8c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0x168]
call fcn.0041d4a3
add esp, 0x16c
ret
Function at 0x40ff90
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x40ffcb
mov eax, dword [esp + 8]
test eax, eax
jne 0x40ffc5
mov eax, dword [0x466b78]
push 0x30
push eax
push str.CAPSLOCK_ON
call fcn.00417ce0
mov ecx, dword [esp + 0x10]
add esp, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
ret
xor eax, eax
ret

Function at 0x410280
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x418
mov eax, dword [0x4527b8]
push ebx
mov dword [esp + 0x418], eax
lea eax, [esp + 4]
push eax
xor ebx, ebx
push 1
push 8
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x410303
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x4102ed
lea ecx, [esp + 4]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x410303
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x414]
call fcn.0041d4a3
add esp, 0x418
ret
mov ecx, dword [esp + 4]
push esi
lea edx, [esp + 0x10]
push edx
push 0x400
lea eax, [esp + 0x24]
push eax
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edx, dword [esp + 8]
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
jne 0x410348
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x414]
call fcn.0041d4a3
add esp, 0x418
ret
lea eax, [esp + 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x410331
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
xor esi, esi
cmp eax, ebx
jbe 0x4103a5
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
push edi
lea edi, [esp + 0x28]
mov edx, dword [edi]
mov eax, dword [esp + 0x14]
push edx
push eax
call ebx
test eax, eax
jne 0x41039f
mov eax, dword [esp + 0x24]
inc esi
add edi, 8
cmp esi, eax
jb 0x410383
jmp 0x4103a4
mov ebp, 1
pop edi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [esp + 0x420]
mov eax, ebp
pop ebp
pop esi
pop ebx
call fcn.0041d4a3
add esp, 0x418
ret