joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003de83
Capabilities:
Delete file

Disassembly:
mov eax, 0x10063821
call fcn.10061bc4
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
mov byte [ebp - 0x18], dl
mov byte [ebp - 0x11], bl
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1003df49
cmp byte [ebp - 0x11], bl
je 0x1003ded1
push ebx
push 0x440e
push 0x5a5a
push 1
push 1
push 0x368b
mov edx, 0x2e8e
mov ecx, 0x3c9b
call fcn.1003db1c
add esp, 0x18
mov dword [ebp - 0x1c], 0x2933
cmp dword [ebp - 0x1c], 0x2a8b
jle 0x1003df12
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x1007f138
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10002c1c
inc edi
cmp edi, 0x45c3
jl 0x1003deec
inc esi
cmp esi, 0xe73
jl 0x1003deea
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x277b
jge 0x1003df2d
mov edx, str.cqmlyon_dsyriqil_cdmtzfmu_isibiga_zmmqh_riebqv_diwdfxj
mov ecx, 0x1007f138
call fcn.100045d3
jmp 0x1003df55
cmp byte [ebp - 0x11], bl
je 0x1003df55
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003e823
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10063869
call fcn.10061bc4
sub esp, 0x3c
push ebx
push esi
mov byte [ebp - 0x14], cl
xor esi, esi
mov dword [ebp - 0x28], 0x6c13
cmp dword [ebp - 0x28], 0x6cf2
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edx
jle 0x1003e8af
mov ebx, esi
mov dword [ebp - 0x20], esi
mov edi, esi
mov eax, esi
mov dword [ebp - 0x1c], 0x4f3f
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], esi
mov ecx, eax
mov esi, ebx
mov ebx, dword [ebp - 0x24]
shl esi, cl
mov eax, esi
mov ecx, 0x1007f138
or eax, ebx
cdq
push edx
push eax
call fcn.10002c1c
inc ebx
cmp ebx, 0x26e
jl 0x1003e86d
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x20]
add eax, edi
dec dword [ebp - 0x1c]
push 0
mov dword [ebp - 0x18], eax
pop esi
jne 0x1003e861
inc edi
cmp edi, 0x60e1
jl 0x1003e855
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, 0xe12
jl 0x1003e853
cmp byte [ebp - 0x14], 0
je 0x1003e990
mov dword [ebp - 0x24], 0x59aa
cmp dword [ebp - 0x24], 0x5d27
jle 0x1003e95b
push 0x258c
push esi
push 0x1c2f
push 0x258a
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov dword [ebp - 0x1c], esi
mov eax, esi
mov dword [ebp - 0x20], 0x6cd4
mov dword [ebp - 0x18], eax
mov ebx, esi
mov edi, esi
or eax, edi
lea ecx, [ebp - 0x44]
or eax, ebx
cdq
push edx
push eax
call fcn.10002a23
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003e90f
mov eax, dword [eax]
push eax
call fcn.10049a06
pop ecx
push esi
push 1
lea ecx, [ebp - 0x44]
call fcn.10002ff9
mov eax, dword [ebp - 0x18]
inc edi
cmp edi, 0x10d
jl 0x1003e8f6
inc ebx
cmp ebx, 0x292f
jl 0x1003e8f4
mov edi, dword [ebp - 0x1c]
add eax, edi
dec dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
jne 0x1003e8f2
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x3987
jl 0x1003e8e6
push 0x1ef4
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x24], 0x58c9
jge 0x1003e96f
push str.ekbcoxax_jdaesg_msj_lxs_vvy_lwrha_fnr_pxwzeyuc_gvdthx_yycjoeuv_plblc_ogsn_praldxh_iadpdbix
call fcn.10049a06
pop ecx
mov edx, dword [ebp + 8]
mov dword [edx], esi
cmp dword [edx], 3
jge 0x1003e9aa
mov esi, dword [ebp - 0x2c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [edx]
cmp dword [edx], 3
jl 0x1003e97c
jmp 0x1003e9aa
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
jmp 0x1003e9a5
mov dword [ebp - 0x2c], 0xfffffffc
cmp dword [ebp - 0x2c], esi
jne 0x1003e9aa
dec dword [eax]
cmp dword [eax], 0xffffffe8
jl 0x1003e997
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x6940
jge 0x1003e9c9
mov edx, str.jblwg_ariuo_rkbttsfho_woezr_aahs_ezwq_qttaljby_iwrbyieaq_dlxv_regg_pie_brtsa_joaomkznq
mov ecx, 0x1007f138
call fcn.100045d3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ee3a
Capabilities:
Encode data using xor
Set environment variable

Disassembly:
mov eax, 0x1006387d
call fcn.10061bc4
sub esp, 0x30
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1003ef9f
mov dword [ebp - 0x1c], 0x1d05
cmp dword [ebp - 0x1c], 0x2067
jle 0x1003eeba
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
lea ecx, [ebp - 0x3c]
cdq
idiv ebx
xor edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10002a23
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003ee8c
mov eax, dword [eax]
push eax
call fcn.10049a06
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10002ff9
inc ebx
cmp ebx, 0x49b6
jl 0x1003ee6e
inc edi
cmp edi, 0x566e
jl 0x1003ee6c
inc esi
cmp esi, 0x6800
jl 0x1003ee6a
cmp dword [ebp - 0x1c], 0x1a86
jge 0x1003eece
push str.jreqvww_wibpes_qdkh_qqmdx_mymirit_omdn_idkz_nagxpzeir_ywg_nhgodrwro
call fcn.10049a06
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x1003ef94
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x1003eefe
push 0x9e8
mov dl, 1
push 0x2d77
push 1
mov cl, dl
call fcn.1003aed7
add esp, 0xc
mov dword [ebp - 0x24], 0x5269
cmp dword [ebp - 0x24], 0x55e2
jle 0x1003ef59
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
lea ebx, [edi + esi]
mov dword [ebp - 0x1c], 0x39b4
xor esi, esi
mov eax, ebx
mov ecx, 0x1007f138
xor eax, esi
cdq
push edx
push eax
call fcn.10002c1c
inc esi
cmp esi, 0xc26
jl 0x1003ef21
dec ebx
dec dword [ebp - 0x1c]
jne 0x1003ef1f
mov esi, dword [ebp - 0x20]
inc edi
cmp edi, 0x5548
jl 0x1003ef15
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x48c9
jl 0x1003ef13
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x50bb
jge 0x1003ef78
mov edx, str.ucn_luxkmy_zkez
mov ecx, 0x1007f138
call fcn.100045d3
jmp 0x1003efbb
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
jmp 0x1003efbb
cmp byte [ebp + 0x14], 0
je 0x1003efb1
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x1003efbb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003f38a
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov eax, 0x10063899
call fcn.10061bc4
sub esp, 0x34
push ebx
push esi
mov dword [ebp - 0x24], 0x2855
mov esi, edx
cmp dword [ebp - 0x24], 0x2b9a
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
jle 0x1003f3ec
xor edi, edi
xor ebx, ebx
xor esi, esi
mov eax, ebx
mov ecx, 0x1007f138
cdq
idiv esi
xor edx, edi
mov eax, edx
cdq
push edx
push eax
call fcn.10002c1c
inc esi
cmp esi, 0x2283
jl 0x1003f3b8
inc ebx
cmp ebx, 0x67d
jl 0x1003f3b6
inc edi
cmp edi, 0x1b90
jl 0x1003f3b4
mov esi, dword [ebp - 0x1c]
cmp byte [ebp + 8], 0
je 0x1003f412
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1003f4d1
push 0x3d6
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1003f4d1
mov dword [ebp - 0x20], 0x602d
cmp dword [ebp - 0x20], 0x6357
jle 0x1003f487
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov eax, edi
xor esi, esi
cdq
idiv ebx
mov edi, edx
mov eax, edi
lea ecx, [ebp - 0x3c]
and eax, esi
cdq
push edx
push eax
call fcn.10002a23
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003f44b
mov eax, dword [eax]
push eax
call fcn.10049a06
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10002ff9
inc esi
cmp esi, 0x2aab
jl 0x1003f432
mov edi, dword [ebp - 0x18]
inc ebx
cmp ebx, 0x25a1
jl 0x1003f429
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x1ee6
jl 0x1003f427
call fcn.10002a5b
mov esi, dword [ebp - 0x1c]
mov dword [esi], 0x18
jmp 0x1003f4b8
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x1c], 0x834d8a94
mov dword [ebp - 0x18], 0
jmp 0x1003f4b0
mov dword [ebp - 0x1c], 0xbd035c57
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jne 0x1003f4a6
dec dword [esi]
cmp dword [esi], 6
jge 0x1003f48f
cmp dword [ebp - 0x20], 0x5e12
jge 0x1003f4d1
push str.kww_rndtvg_ougpajw
call fcn.10049a06
pop ecx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x25d5
jge 0x1003f4f0
mov edx, str.ocbi_rsulz_zutleg_lln_xwk_mflwczf_mmuxt_zwkr_nkifuoo_eyiohd_xkhjnll_ypdhkdcdw
mov ecx, 0x1007f138
call fcn.100045d3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003f67a
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x100638a3
call fcn.10061bc4
sub esp, 0x20
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1003f76e
xor ebx, ebx
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x24], 0x471
cmp dword [ebp - 0x24], 0x578
jle 0x1003f71c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, edi
mov dword [ebp - 0x28], esi
cdq
idiv ecx
mov dword [ebp - 0x2c], ebx
mov ecx, edx
shl esi, cl
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x1007f138
cdq
push edx
push eax
call fcn.10002c1c
inc ebx
cmp ebx, 0x2159
jl 0x1003f6d6
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x1c], ecx
push 0
pop ebx
cmp ecx, 0x8ad
jl 0x1003f6c7
inc edi
cmp edi, 0x13d5
jl 0x1003f6c2
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x73de
jl 0x1003f6c0
cmp byte [ebp - 0x11], 0
je 0x1003f737
push 0x283e
push ecx
push 1
mov ecx, 0x3ed9
call fcn.1003bae9
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0xfc
jge 0x1003f752
mov edx, str.zkchkrozi_wbzfxacf_fdirib_teyqiu_zpsi_iqqanp_zom_gnwys_ggsi_ihvt
mov ecx, 0x1007f138
call fcn.100045d3
jmp 0x1003f779
push 0x268a
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003f90e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100638ad
call fcn.10061bc4
sub esp, 0x10
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
je 0x1003f949
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1003f9f6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1003f9f6
mov dword [ebp - 0x18], 0x27ee
cmp dword [ebp - 0x18], 0x29ef
jle 0x1003f9ae
xor esi, esi
xor ebx, ebx
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, edi
sar eax, cl
mov ecx, 0x1007f138
xor eax, ebx
xor eax, esi
cdq
push edx
push eax
call fcn.10002c1c
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x6f48
jl 0x1003f964
inc edi
cmp edi, 0x3d3
jl 0x1003f95f
inc ebx
cmp ebx, 0x543
jl 0x1003f95d
inc esi
cmp esi, 0x24b9
jl 0x1003f95b
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
mov edi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x2768
jge 0x1003f9e9
mov edx, str.infywxq_mopgkpcyu_zuzadsi_loxxvssz_hdwjziyky_dcpbvaqf_pvh_sswihozma_ctbuvodeu_mxzmarr_xnoov_uymqvzfif
mov ecx, 0x1007f138
call fcn.100045d3
jmp 0x1003f9e9
cmp byte [edi], 0
je 0x1003f9f6
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401190
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x422fe0]
test eax, eax
push esi
push edi
je 0x4011eb
mov eax, dword [esp + 0x10]
mov edx, dword [0x422044]
mov ecx, dword [0x422048]
lea esi, [edx + eax]
cmp esi, ecx
jl 0x4011b6
sub ecx, edx
mov eax, ecx
test eax, eax
jle 0x40125f
mov esi, dword [0x422040]
mov edi, dword [esp + 0xc]
add esi, edx
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x422044]
add ecx, eax
pop edi
mov dword [0x422044], ecx
pop esi
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
push eax
push ecx
push 1
push esi
call fcn.004138c5
mov edi, eax
mov eax, dword [0x422fd0]
add esp, 0x10
test eax, eax
je 0x40125d
test edi, edi
jle 0x40125d
mov edx, dword [0x422e3c]
mov eax, dword [0x422e20]
lea ecx, [eax + edx]
mov edx, dword [0x422e2c]
mov eax, dword [0x422e28]
add eax, edx
and ecx, 0xff
and eax, 0xff
test edi, edi
jle 0x40125d
mov dl, byte [0x422e34]
push ebx
push ebp
mov ebp, edi
mov bl, byte [esi]
sub bl, al
xor bl, cl
add dl, bl
mov byte [esi], dl
inc esi
dec ebp
jne 0x401247
pop ebp
mov byte [0x422e34], dl
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x40bd60
Capabilities:
Create process on windows

Disassembly:
mov cl, byte [esp + 4]
sub esp, 0x3c
test cl, 2
mov eax, 0xa
je 0x40bd76
mov eax, 2
cmp byte [esi], 0
je 0x40bddc
push edi
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov eax, dword [0x4238e0]
mov ecx, dword [eax + 0x34]
mov dword [esp + 0x14], edx
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0xc
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
pop edi
jne 0x40be3b
push 0x420738
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x48], 0xe
call fcn.00413d80
test cl, 0x10
push eax
je 0x40bdf9
push 0x41f321
push 0x41f321
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40be1f
test cl, 0x20
je 0x40be18
push 0x41f321
push 0x41f321
push edx
push str.print
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40be1f
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jge 0x40be3b
push 0x420738
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], 0xe
call fcn.00413d80
add esp, 0x3c
ret
Function at 0x40be40
Capabilities:
Get common file path

Disassembly:
mov edx, dword [0x423888]
sub esp, 0x10c
cmp eax, 4
lea ecx, [edx + 0x338]
push esi
mov esi, dword [ecx]
ja case.default.0x40be5e
jmp dword [eax*4 + 0x40bf68]
push 0x104
push esi
call fcn.00414edd
add esp, 8
push 0x5c
push esi
call fcn.00413470
add esp, 8
mov eax, esi
pop esi
add esp, 0x10c
ret
push 0x104
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x20
lea ecx, [esp + 0xc]
push esi
push ecx
call fcn.004130a0
add esp, 0xc
push 0x5c
push esi
call fcn.00413470
add esp, 8
mov eax, esi
pop esi
add esp, 0x10c
ret
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x5c
push esi
call fcn.00413470
add esp, 8
mov eax, esi
pop esi
add esp, 0x10c
ret
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5c
push esi
call fcn.00413470
add esp, 8
mov eax, esi
pop esi
add esp, 0x10c
ret
mov edx, dword [edx + 0x368]
push edx
push ecx
call fcn.00409490
mov eax, dword [0x423888]
mov eax, dword [eax + 0x338]
add esp, 8
pop esi
add esp, 0x10c
ret
test eax, 0x10000
je 0x40bf51
push 0
and eax, 0xffff
push eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x5c
push esi
call fcn.00413470
add esp, 8
mov eax, esi
pop esi
add esp, 0x10c
ret
push 0x420738
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 3
call fcn.00413d80
mov esi, 0xbe880040
inc eax
add byte [edi - 0x1fffbf42], bh
mov esi, 0xbf010040
inc eax
add ah, cl
int3
Function at 0x40bf80
Capabilities:
Get hostname
Get memory capacity
Get session user name
Get system information on windows

Disassembly:
sub esp, 0xcc
push ebx
push ebp
mov ebx, eax
test bl, 0x10
mov eax, dword [0x423888]
mov ebp, dword [eax + 0x338]
push esi
mov esi, 4
mov dword [esp + 0xc], 0x104
je 0x40bfb3
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
test bl, 0x20
je 0x40bfdc
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
and ebx, 0xf
mov eax, dword [esp + ebx*4 + 0x38]
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 4
pop ebx
add esp, 0xcc
ret
cmp ebx, 0x11
ja case.0x40bfec.3
movzx ecx, byte [ebx + 0x40c13c]
jmp dword [ecx*4 + 0x40c124]
mov edx, dword [str.Windows]
mov dword [ebp], edx
mov eax, dword [0x41f434]
push edi
mov dword [ebp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov edi, ebp
dec edi
test eax, eax
js 0x40c030
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c012
mov cx, word [0x41f42c]
mov word [edi], cx
mov dl, byte [0x41f42e]
jmp 0x40c048
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c030
mov cx, word [0x41f428]
mov word [edi], cx
mov dl, byte [0x41f42a]
movzx ecx, ah
push ecx
and eax, 0xff
push eax
mov byte [edi + 2], dl
lea edx, [esp + 0x64]
push str._ver_d._d
push edx
call fcn.00413a84
lea eax, [esp + 0x6c]
add esp, 0x10
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c070
sub eax, edx
dec ebp
mov edi, ebp
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c080
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 2
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
lea eax, [esp + 0xc]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esi, 2
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
lea ecx, [esp + 0xc]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov esi, 2
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
mov edx, dword [esp + 0x2c]
mov eax, esi
pop esi
mov dword [ebp], edx
pop ebp
pop ebx
add esp, 0xcc
ret
mov eax, dword [esp + 0x28]
mov dword [ebp], eax
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
push 0x420738
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 3
call fcn.00413d80
lea ecx, [ecx]
mov edi, 0xc0aa0040
inc eax
add bh, al
rol byte [eax], 0xe4
rol byte [eax], 0xf7
rol byte [eax], 0xa
rol dword [eax], 0
add dword [edx], eax
add eax, 84215045
add eax, 84215045
add eax, 67306757
int3
Function at 0x40da90
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 0x24
push esi
mov esi, eax
cmp esi, 4
jl 0x40dab5
cmp esi, 0xb
jg 0x40dab5
mov ecx, dword [0x4238e0]
mov edx, dword [ecx + 0x34]
lea eax, [esp + 0x18]
push eax
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp esi, 0x1b
ja case.default.0x40dac4
mov ecx, dword [0x4238e0]
jmp dword [esi*4 + 0x40dcb8]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
pop esi
add esp, 0x24
ret
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x14]
pop esi
add esp, 0x24
ret
mov ecx, dword [0x4238dc]
call fcn.004100d0
pop esi
add esp, 0x24
ret
mov eax, dword [0x4238f0]
pop esi
add esp, 0x24
ret
mov eax, dword [esp + 0x18]
pop esi
add esp, 0x24
ret
mov eax, dword [esp + 0x1c]
pop esi
add esp, 0x24
ret
mov eax, dword [esp + 0x20]
pop esi
add esp, 0x24
ret
mov eax, dword [esp + 0x24]
pop esi
add esp, 0x24
ret
mov edx, dword [0x4238e0]
mov eax, dword [edx + 0x5c]
pop esi
add esp, 0x24
ret
mov eax, dword [0x4238e0]
mov eax, dword [eax + 0x60]
pop esi
add esp, 0x24
ret
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
pop esi
add esp, 0x24
ret
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
pop esi
add esp, 0x24
ret
mov ecx, dword [0x4238e0]
cmp dword [ecx + 0x44], 1
je case.0x40dac4.26
lea edx, [esp + 8]
push edx
lea eax, [esp + 8]
push eax
call fcn.004115d0
mov eax, dword [esp + 4]
pop esi
add esp, 0x24
ret
mov eax, dword [ecx + 4]
pop esi
add esp, 0x24
ret
cmp dword [ecx + 0x44], 1
je case.0x40dac4.27
lea edx, [esp + 8]
push edx
lea eax, [esp + 8]
push eax
call fcn.004115d0
mov eax, dword [esp + 8]
pop esi
add esp, 0x24
ret
mov eax, dword [ecx + 8]
pop esi
add esp, 0x24
ret
mov ecx, dword [0x4238e0]
mov eax, dword [ecx + 0x110]
pop esi
add esp, 0x24
ret
mov edx, dword [0x4238e0]
mov eax, dword [edx + 0x114]
pop esi
add esp, 0x24
ret
mov eax, dword [0x4238e0]
movzx eax, byte [eax + 0xa0]
pop esi
add esp, 0x24
ret
mov ecx, dword [0x4238e0]
movzx eax, byte [ecx + 0xa1]
pop esi
add esp, 0x24
ret
mov edx, dword [0x4238e0]
movzx eax, byte [edx + 0xa2]
pop esi
add esp, 0x24
ret
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x26
push esi
mov dword [esp + 0xc], 0
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
test ah, 1
je 0x40dc37
mov dword [esp + 4], 1
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 4]
pop esi
add esp, 0x24
ret
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
pop esi
add esp, 0x24
ret
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
pop esi
add esp, 0x24
ret
mov eax, dword [0x4238e0]
mov eax, dword [eax + 0x6c]
pop esi
add esp, 0x24
ret
mov ecx, dword [0x4238e0]
mov eax, dword [ecx + 0x70]
pop esi
add esp, 0x24
ret
mov edx, dword [0x423888]
mov eax, dword [edx + 0x324]
pop esi
add esp, 0x24
ret
mov ecx, dword [0x4238dc]
call fcn.00410250
pop esi
add esp, 0x24
ret
push 0x420738
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x15
call fcn.00413d80
mov edi, edi
retf
Function at 0x40e430
Capabilities:
Log keystrokes

Disassembly:
push ecx
push edi
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [0x423904]
test byte [eax + 0x30c], 2
je 0x40e4bc
mov edx, dword [esi + 4]
cmp edx, 0x200
mov edi, dword [0x4238fc]
jne 0x40e49d
test edi, edi
movzx eax, word [esi + 0xc]
movzx ecx, word [esi + 0xe]
jne 0x40e492
cmp dword [0x4238f4], eax
jne 0x40e47b
cmp dword [0x4238f8], ecx
je 0x40e49d
push 0x420738
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0
call fcn.00413d80
mov dword [0x4238f4], eax
mov dword [0x4238f8], ecx
cmp edx, 0x100
jne 0x40e4bc
test edi, edi
jne 0x40e4bc
push 0x420738
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], edi
call fcn.00413d80
cmp dword [esi + 4], 0x100
jne 0x40e4fa
cmp dword [esi + 8], 9
jne 0x40e4d0
call fcn.0040e180
push 2
call fcn.00403a20
add esp, 4
test eax, eax
je 0x40e4fa
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ecx
push eax
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 2
call fcn.00404760
add esp, 0x10
pop edi
pop ecx
ret