joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428d08
Capabilities:
Hash data using murmur3

Disassembly:
xor edi, ebp
xor ecx, 0x96211276
sub edx, 0x21e11256
xor ebx, esi
or edi, dword [0x653ed1]
ror esi, 2
or ebx, dword [0x653fbd]
dec esi
neg eax
or dword [0x653ca3], ecx
call fcn.005c306f
neg ecx
and dword [0x653cb5], esi
xor dword [0x653db7], eax
neg ecx
call fcn.0041f6e6
xor dword [0x653d0b], ecx
neg eax
inc esi
rol esi, 2
xor ebx, esi
add edx, 0x21e11256
xor ecx, 0x96211276
xor edi, ebp
add ebx, 0x610d20c5
rol edi, 0x1a
add edx, 0x94672e61
add eax, edi
neg esi
xor esi, 0xba15ac8e
sub esi, 0x4069ab2c
xor edx, 0xf3963884
neg eax
add ecx, 0x2dea7698
sub esi, 0x4bc4721d
neg ecx
inc esi
add eax, esi
xor ebx, 0xe39c59b8
sub dword [0x653cbd], eax
neg eax
sub ebx, eax
xor edi, ebp
xor edi, dword [0x653e0e]
ror eax, 9
xor esi, esp
xor ebx, dword [0x653eb7]
xor dword [0x653cd0], edx
rol eax, 0x11
call fcn.0041916e
xor dword [0x653c31], edx
not esi
inc eax
sub edx, 0xa058f36e
add edx, 0xa058f36e
dec eax
not esi
call fcn.00561089
ror eax, 0x11
xor esi, esp
rol eax, 9
xor edi, ebp
add ebx, eax
neg eax
xor ebx, 0xe39c59b8
sub eax, esi
dec esi
neg ecx
add esi, 0x4bc4721d
sub ecx, 0x2dea7698
sub eax, 0xf281d8f7
loop 0x428da5
out dx, eax
popfd
dec ecx
add dword [0x653cbc], edx
dec esi
xchg eax, esi
neg eax
xchg ebx, esi
sub edx, dword [0x653f0b]
dec edx
sub ebx, 0x91192c92
xor ecx, dword [0x653f63]
xchg ebx, eax
xor edi, 0xb415f11e
not esi
add ecx, ebx
or dword [0x653c33], eax
inc eax
call fcn.004437b1
xchg ecx, eax
dec ecx
sub esi, eax
call fcn.0040b51f
add esi, eax
inc ecx
xchg ecx, eax
call fcn.0059db49
dec eax
add dword [0x653c16], edx
sub ecx, ebx
not esi
xor edi, 0xb415f11e
xchg ebx, eax
add ebx, 0x91192c92
inc edx
xchg ebx, esi
neg eax
xchg eax, esi
inc esi
and dword [0x653dc9], edi
inc ecx
push edx
xchg ecx, esi
ror edi, 0xe
add ecx, edx
ror ecx, 0x19
call fcn.004c81eb
add edx, dword [0x653f69]
ror edx, 0x14
inc ecx
call fcn.004f9978
xchg edi, eax
and dword [0x653c6f], eax
rol esi, 4
neg ebx
xchg esi, eax
call fcn.00408f30
xor edx, eax
call fcn.004939b4
call fcn.00588b50
xor edx, eax
xchg esi, eax
neg ebx
ror esi, 4
xchg edi, eax
call fcn.0043a6b1
dec ecx
rol edx, 0x14
call fcn.004e972e
invalid
invalid

Function at 0x428e10
Capabilities:
Hash data using murmur3

Disassembly:
add eax, 0x653cbd
sub eax, 0xf281d8f7
loop 0x428da5
out dx, eax
popfd
Function at 0x42908c
Capabilities:
Hash data using murmur3

Disassembly:
jmp 0x428ffa
in al, dx
cmp al, 0x65
add byte [ecx - 0x6385b537], al
push cs
not ebx
sub dword [0x653c93], edi
add ebx, dword [0x653df4]
xor edi, ebx
add ebx, dword [0x653f86]
call fcn.004114e4
inc esi
sub esi, ecx
or dword [0x653d30], ecx
add ecx, dword [0x653f85]
add eax, dword [0x653f1b]
xor edx, ecx
ror edx, 0x1d
sub edi, 0xd6ace1e5
not ecx
xor dword [0x653c2e], esi
xor edi, 0xcca88c51
call fcn.004f987d
xor edi, 0xcca88c51
and dword [0x653cc7], ebx
not ecx
add edi, 0xd6ace1e5
rol edx, 0x1d
xor edx, ecx
xor dword [0x653dac], eax
add esi, ecx
dec esi
call fcn.004a011d
xor edi, ebx
not ebx
xor ecx, 0x9fbffece
xor ebx, 0xe98cdd25
or dword [0x653c1d], ecx
cmp al, 0x65
add byte [ecx], ah
add eax, 0x653c24
xor edi, 0xe8b1d8
xor ecx, dword [0x653e79]
dec ecx
sub eax, 0x8c2eaf76
and dword [0x653c9e], eax
rol esi, 6
or ebx, dword [0x653eb1]
add ecx, dword [0x653e82]
sub esi, dword [0x653df0]
not esi
call fcn.00403c6a
not ebx
inc ebx
add eax, dword [0x653e62]
inc edx
call fcn.0048c221
dec edx
dec ebx
not ebx
call fcn.005b36e4
not esi
ror esi, 6
add eax, 0x8c2eaf76
inc ecx
xor edi, 0xe8b1d8
xor ebx, 0xe98cdd25
push ecx
or edx, dword [0x653f88]
mov dword [0x653d2d], ecx
call fcn.005a296d
inc edx
sub ecx, 0x1355d975
sub dword [0x653ca1], ebx
xor ecx, 0xf7af511c
or dword [0x653d21], eax
or dword [0x653c00], edi
inc ecx
or esi, dword [0x653e81]
add dword [0x653c13], ebx
neg edi
xor dword [0x653c19], ebx
rol edx, 0x19
call fcn.0040a39d
Function at 0x429148
Capabilities:
Hash data using murmur3

Disassembly:
ror edx, 0x19
or dword [0x653c9f], edx
neg edi
dec ecx
or dword [0x653d6e], eax
and dword [0x653cb6], ecx
xor ecx, 0xf7af511c
add dword [0x653da9], ecx
add ecx, 0x1355d975
dec edx
call fcn.00522a2b
add dword [0x653c04], esi
call eax
ror ebx, 9
xor edi, 0xd38a710a
sub ecx, dword [0x653ecc]
xor edx, eax
call fcn.00551411
xor dword [0x653c93], ebx
ror ecx, 9
call fcn.0042d1c9
rol ecx, 0x15
not esi
rol edi, 0x18
dec eax
xor ecx, dword [0x653ea4]
xor eax, 0x3f77e1e6
or ebx, dword [0x653f41]
rol esi, 0x10
and dword [0x653d23], 0x295eb577
sub esi, dword [0x653ede]
call fcn.00603647
sub dword [0x653c00], esi
and dword [0x653d19], edx
xor dword [0x653cbe], 0xf7982b3f
ror esi, 0x10
xor eax, 0x3f77e1e6
inc eax
ror edi, 0x18
not esi
ror ecx, 0x15
rol ecx, 9
sub dword [0x653d17], eax
xor edx, eax
xor edi, 0xd38a710a
rol ebx, 9
lea esi, [0xa61a1edc]
dec ecx
xor edx, ecx
sub esi, 0x67f065cd
dec esi
sub esi, dword [0x653e89]
call fcn.0050dede
xor dword [0x653da5], ebx
call fcn.0059065d
sub eax, dword [0x653f24]
inc eax
xor ebx, 0x5a8f0af5
or edi, dword [0x653e58]
sub edx, 0x367352f7
xchg eax, edx
add edi, ebx
call fcn.005e5a8f
xor ebx, 0x1cda8d26
call fcn.0056c070
call fcn.00455964
xor ebx, 0x1cda8d26
call fcn.0041f6e6
sub edi, ebx
xchg eax, edx
add edx, 0x367352f7
xor ebx, 0x5a8f0af5
dec eax
call fcn.005844cb
mov dword [0x653d26], edi
call fcn.0056c070
inc esi
add esi, 0x67f065cd
xor edx, ecx
inc ecx
or esi, 0xdf903634
inc ebx
or edx, dword [0x653f0c]
call fcn.005e79fa
mov dword [0x653cbd], ebx
neg esi
xor ebx, dword [0x653f9f]
rol eax, 0x12
not esi
or dword [0x653c23], esi
call fcn.0043fb84
call fcn.005d3666
sub dword [0x653d3e], edi
not esi
ror eax, 0x12
neg esi
mov dword [0x653d93], edx
call fcn.00559f3c
dec ebx
xor esi, 0xfff396fc
add edx, 0xcfa8dc5d
call fcn.0051eb68
or edx, dword [0x653ebe]
inc ecx
inc ebx
rol esi, 0xf
add eax, dword [0x653e7f]
xor dword [0x653d03], edi
neg ecx
add dword [0x653c93], edx
xor edi, dword [0x653fb4]
call fcn.0058ea11
xor dword [0x653cd8], ebx
neg ecx
invalid
into

Function at 0x46b108
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x46b156
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0046abb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46b16f
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x46b178
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0046abb4
dec esi
jne 0x46b19a
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x46d864
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x6599d0
cmp dword [edi], 0
jne 0x46d8e0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x6599cc]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x650684
mov ecx, 2
call fcn.004056d0
mov edx, 0x46d83c
lea eax, [esi + 5]
call fcn.0046d85c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0046d85c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x46d8b5
mov dword [0x6599cc], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4b1858
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x4b1860
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4c87c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004097c0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.004c829c
test al, al
jne 0x4c8829
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x653a38]
mov dl, 1
mov eax, dword [0x4c6fd0]
call fcn.004266bc
call fcn.00407e08
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004c8204
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4cfbe4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4cfbea
ret
Function at 0x5a5094
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5a5131
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004272d4
cmp eax, 2
jne 0x5a50d7
push 1
mov eax, esi
call fcn.004097c0
push eax
mov eax, edi
call fcn.004097c0
push eax
call sub.kernel32.dll_MoveFileExW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x5a511b
mov eax, esi
call fcn.004097c0
mov edx, eax
lea eax, [ebp - 4]
call fcn.00409828
mov eax, dword [ebp - 4]
call fcn.004210cc
mov ebx, eax
test bl, bl
jne 0x5a5100
call sub.kernel32.dll_GetLastError
cmp eax, 2
jne 0x5a511b
mov eax, esi
call fcn.004097c0
push eax
mov eax, edi
call fcn.004097c0
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a5138
lea eax, [ebp - 4]
call fcn.0040870c

Function at 0x5a7648
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret
Function at 0x5daef8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ebx, ebx
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x5daf44
cmp dword [ebp - 0x104], 2
jne 0x5daf44
cmp dword [ebp - 0x110], 5
ja 0x5daf42
cmp dword [ebp - 0x110], 5
jne 0x5daf44
cmp dword [ebp - 0x10c], 1
jb 0x5daf44
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5daf4c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.004219bc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ddf04
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.004219bc
pop ebx
mov esp, ebp
pop ebp

Function at 0x5e1b5c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.004219bc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5e36f4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
xor edx, edx
mov dword [ebp - 0x25c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5e37c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x258]
push eax
lea edx, [ebp - 0x25c]
mov eax, ebx
call fcn.005a2674
lea eax, [ebp - 0x25c]
mov edx, 0x5e37e4
call fcn.004099bc
mov eax, dword [ebp - 0x25c]
call fcn.004097c0
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x5e37ad
xor eax, eax
push ebp
push 0x5e37a6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
call fcn.005e36a4
test al, al
je 0x5e377b
mov byte [ebp - 1], 1
jmp 0x5e378f
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5e3766
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e37ad
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e37cd
lea eax, [ebp - 0x25c]
call fcn.0040870c
ret

Function at 0x5e37e8
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
push 0x200
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.004097c0
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5e3828
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.00409864
jmp 0x5e382f
mov eax, ebx
call fcn.0040870c
add esp, 0x2b4
pop esi
pop ebx
ret
Function at 0x5ed410
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x5ed46a
inc esi
xor edi, edi
cmp edi, 1
jne 0x5ed436
mov eax, dword [ebp + 0xc]
push eax
call fcn.00427dd4
jmp 0x5ed444
cmp edi, 1
jle 0x5ed444
mov eax, dword [ebp + 8]
push eax
call fcn.00427dd4
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005ea178
test eax, eax
jne 0x5ed46a
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x5ed46a
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x5ed46a
inc edi
dec esi
jne 0x5ed426
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x5edcd4
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
push 0
push 2
lea eax, [esp + 8]
push eax
call fcn.005a3ed8
and eax, 0x7f
mov ecx, dword [eax*4 + 0x652ae4]
mov edx, 0x80000002
xor eax, eax
call fcn.005a4104
test eax, eax
jne 0x5edd1e
mov eax, esi
call fcn.004097c0
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueW
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
call fcn.004097c0
push eax
call sub.gdi32.dll_RemoveFontResourceW
test eax, eax
je 0x5edd3f
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageW
pop edx
pop esi
pop ebx
ret
Function at 0x60d5ec
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x60d6c6
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x60d6d8
call fcn.005f4020
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x60d644
mov eax, 0x60d738
call fcn.005f3d9c
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x60d62f
push esp
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x60d697
cmp dword [esp], 0
jne 0x60d679
mov eax, 0x60d790
call fcn.005f3d9c
jmp 0x60d6a1
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x60d7cc
call fcn.005f4020
jmp 0x60d6a1
mov eax, 0x60d834
call fcn.005f3d9c
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x60d6c6
push 0xfa
call fcn.00427dd4
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x401e10
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xc8
lea eax, [esp]
push esi
mov esi, dword [esp + 0xd0]
push edi
push 0x64
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea ecx, [esp + 0x6c]
push 0x64
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
lea edx, [esp + 8]
push 0x4062c8
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401e6d
cmp edi, 0x960f0000
jne 0x401e6d
mov eax, esi
pop edi
pop esi
add esp, 0xc8
ret
pop edi
or eax, 0xffffffff
pop esi
add esp, 0xc8
ret

Function at 0x401e80
Capabilities:
Get graphical window text
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
push edi
push esi
call fcn.00401e10
add esp, 4
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x401ff3
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x104
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [0x407388]
lea edx, [esp + 8]
push ecx
push edx
push 0x406534
call fcn.00401680
add esp, 0xc
test eax, eax
jne 0x401ff3
lea eax, [esp + 8]
push eax
call fcn.004016c0
add esp, 4
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x401ff3
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x118
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [0x406520], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [0x406530], eax
mov dword [eax], 0x14
mov ecx, dword [0x406530]
mov edi, 0x40738c
mov dword [ecx + 0xc], 0
mov edx, dword [0x406530]
or ecx, 0xffffffff
mov dword [edx + 0x10], 0
mov eax, dword [0x406530]
lea edx, [eax + 0x14]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x40651c], edx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x406520]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [0x406520]
test eax, eax
jne 0x401fa4
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
add esp, 0x104
ret
mov edx, dword [0x406530]
push edx
push 0xf
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x11
call esi
mov edi, dword [sym.imp.USER32.dll_VkKeyScanA]
push 0
push 0
push 0
push 0x76
call edi
push eax
call esi
push 0
push 2
push 0
push 0x11
call esi
push 0
push 2
push 0
push 0x76
call edi
push eax
call esi
pop edi
pop esi
add esp, 0x104
ret
Function at 0x4038a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov cl, 0x65
mov al, 0x74
mov dl, 0x41
push 0x405328
mov byte [esp + 4], 0x47
mov byte [esp + 5], cl
mov byte [esp + 6], al
mov byte [esp + 7], 0x46
mov byte [esp + 8], 0x69
mov byte [esp + 9], 0x6c
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], dl
mov byte [esp + 0xc], al
mov byte [esp + 0xd], al
mov byte [esp + 0xe], 0x72
mov byte [esp + 0xf], 0x69
mov byte [esp + 0x10], 0x62
mov byte [esp + 0x11], 0x75
mov byte [esp + 0x12], al
mov byte [esp + 0x13], cl
mov byte [esp + 0x14], 0x73
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403925
mov edx, dword [esp + 0x18]
push edx
call eax
add esp, 0x14
ret
mov eax, dword [esp + 0x18]
add esp, 0x14
ret

Function at 0x403930
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov cl, 0x13
mov dl, byte [eax + 0x40536c]
xor dl, cl
mov byte [eax + 0x40536c], dl
inc eax
cmp eax, 0x5dc
jb 0x403934
xor eax, eax
ret

Function at 0x403950
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov cl, 0x13
mov dl, byte [eax + 0x405948]
xor dl, cl
mov byte [eax + 0x405948], dl
inc eax
cmp eax, 0x8c0
jb 0x403954
xor eax, eax
ret

Function at 0x403ac0
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
xor esi, esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x403ade
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x403ade
mov eax, dword [eax]
pop esi
ret
mov eax, esi
pop esi
ret

Function at 0x403af0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
sub esp, 0x10
push esi
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x403b10
mov eax, 1
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
push eax
call fcn.00403ac0
add esp, 4
mov word [esp + 4], 2
mov dword [esp + 8], eax
push 0x1bd
call sub.WS2_32.dll_htons
lea ecx, [esp + 4]
push 0x10
push ecx
push esi
mov word [esp + 0x12], ax
call sub.WS2_32.dll_connect
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x10
ret

Function at 0x403e90
Capabilities:
Create thread
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
push edi
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0x104
push 0x407150
call fcn.00402280
push 0x58
push 0x43
call fcn.00403970
add esp, 0x10
push eax
push 0x59
push 0x42
call fcn.00403970
add esp, 8
push eax
push 0x5a
push 0x41
call fcn.00403970
add esp, 8
push eax
push 0x407150
push 0x4064fc
push 0x407490
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x407490
call fcn.004039b0
add esp, 0x1c
push 0x407268
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7d0
call esi
push 0
push 0
push 0
push 0x403b50
push 0
push 0
call edi
jmp 0x403f16