joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455278
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4553e1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404874
mov eax, dword [ebp - 0x10]
call fcn.00454e58
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x4552ca
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404d2c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004556c4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x45539f
xor eax, eax
push ebp
push 0x455398
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00454f98
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.004553f0
test al, al
je 0x455376
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004048cc
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x455376
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404c8c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x455370
mov eax, dword [ebp - 0x14]
call fcn.00404c8c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004049cc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.00455278
dec ebx
cmp ebx, 0xffffffff
jne 0x455329
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45539f
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00454f98
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00404c8c
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00454f84
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4553e8
lea eax, [ebp - 0x3c]
call fcn.004047dc
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404800
ret
Function at 0x45539f
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4553e1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404874
mov eax, dword [ebp - 0x10]
call fcn.00454e58
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x4552ca
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404d2c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004556c4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x45539f
xor eax, eax
push ebp
push 0x455398
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00454f98
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.004553f0
test al, al
je 0x455376
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004048cc
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x455376
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404c8c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x455370
mov eax, dword [ebp - 0x14]
call fcn.00404c8c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004049cc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.00455278
dec ebx
cmp ebx, 0xffffffff
jne 0x455329
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45539f
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00454f98
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00404c8c
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00454f84
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4553e8
lea eax, [ebp - 0x3c]
call fcn.004047dc
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404800
ret

Function at 0x4553f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.004031a4
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x482e48]
cmp byte [edx + 0xc], 0
je 0x455454
mov edx, dword [0x482e40]
cmp dword [edx], 2
jne 0x455454
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x455458
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x455510
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004553f0
test al, al
je 0x4554f2
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004048cc
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x4554f2
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404c8c
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00404c8c
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004049cc
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x4554ab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455517
lea eax, [ebp - 0x2c]
call fcn.004047dc
lea eax, [ebp - 0xc]
call fcn.004047dc
ret

Function at 0x455640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404c8c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x455698
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x482e58]
mov dl, 1
mov eax, dword [0x454d64]
call fcn.0040ac80
call fcn.0040419c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00454e6c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x456f2c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x456fc0
push 0
mov eax, ebx
call fcn.00404c8c
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x456f9b
mov eax, esi
call fcn.00404a94
inc eax
push eax
mov eax, esi
call fcn.00404c8c
push eax
push 1
push 0
mov eax, edi
call fcn.00404c8c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x456fb6
mov ecx, dword [0x482b5c]
mov dl, 1
mov eax, dword [0x455d24]
call fcn.0040ac44
call fcn.0040419c
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x457014
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x411f74]
call fcn.00405210
xor eax, eax
push ebp
push 0x457158
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x480c8c], 0
jne 0x457067
mov ecx, dword [0x482a38]
mov dl, 1
mov eax, dword [0x407d2c]
call fcn.0040ac44
call fcn.0040419c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004031a4
mov eax, ebx
call fcn.00405060
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x457168
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004065b8
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405070
test eax, eax
jle 0x4570ff
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4570f8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404a5c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404a44
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408bbc
test eax, eax
jne 0x4570f8
mov ebx, 0x15
jmp 0x457104
mov ebx, 0x10
jmp 0x457104
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x480c8c]
call fcn.00456ebc
mov eax, dword [ebp - 8]
call fcn.00456ebc
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004065d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45715f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404800
lea eax, [ebp - 0x10]
mov edx, dword [0x411f74]
call fcn.004052e0
ret
Function at 0x458b38
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
movzx eax, word [esi + 0x54]
mov dword [esp], eax
xor edx, edx
mov dl, byte [esi + 0x1098]
mov ecx, dword [esp]
mov eax, esi
call fcn.00458888
mov ebx, eax
mov eax, dword [esi + 0x4c]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
test bl, bl
jbe 0x458c1c
xor ecx, ecx
mov cl, byte [esi + 0x1098]
lea edx, [esi + 0x1057]
mov eax, dword [esi + 0x34]
call fcn.0040295c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x30]
mov edi, ebx
and edi, 0xff
dec edi
test di, di
jb 0x458bc2
inc edi
xor eax, eax
movzx edx, ax
mov ecx, edx
add ecx, dword [esp + 4]
mov cl, byte [esi + ecx + 0x56]
xor cl, byte [esi + edx + 0x1057]
push ecx
mov ecx, dword [esp + 0xc]
add ecx, edx
pop edx
mov byte [ecx], dl
inc eax
dec di
jne 0x458b9e
mov al, byte [esi + 0x1098]
cmp bl, al
jne 0x458bde
xor ecx, ecx
mov cl, al
mov edx, dword [esi + 0x34]
mov eax, dword [esp + 8]
call fcn.0040295c
jmp 0x458bf1
xor eax, eax
mov al, bl
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x34]
mov eax, esi
call fcn.00458894
xor eax, eax
mov al, bl
sub dword [esp], eax
add dword [esp + 8], eax
add dword [esp + 4], eax
xor edx, edx
mov dl, byte [esi + 0x1098]
mov ecx, dword [esp]
mov eax, esi
call fcn.00458888
mov ebx, eax
test bl, bl
ja 0x458b70
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x458c24
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
movzx eax, word [esi + 0x54]
mov dword [esp], eax
xor edx, edx
mov dl, byte [esi + 0x1098]
mov ecx, dword [esp]
mov eax, esi
call fcn.00458888
mov ebx, eax
mov eax, dword [esi + 0x4c]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
test bl, bl
jbe 0x458d10
xor ecx, ecx
mov cl, byte [esi + 0x1098]
lea edx, [esi + 0x1057]
mov eax, dword [esi + 0x34]
call fcn.0040295c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x30]
mov al, byte [esi + 0x1098]
cmp bl, al
jne 0x458c99
xor ecx, ecx
mov cl, al
mov edx, dword [esi + 0x34]
mov eax, dword [esp + 4]
lea eax, [esi + eax + 0x56]
call fcn.0040295c
jmp 0x458cb0
xor eax, eax
mov al, bl
push eax
mov eax, dword [esp + 8]
lea ecx, [esi + eax + 0x56]
mov edx, dword [esi + 0x34]
mov eax, esi
call fcn.00458894
mov edi, ebx
and edi, 0xff
dec edi
test di, di
jb 0x458ce5
inc edi
xor eax, eax
movzx edx, ax
mov ecx, edx
add ecx, dword [esp + 4]
mov cl, byte [esi + ecx + 0x56]
xor cl, byte [esi + edx + 0x1057]
push ecx
mov ecx, dword [esp + 0xc]
add ecx, edx
pop edx
mov byte [ecx], dl
inc eax
dec di
jne 0x458cc1
xor eax, eax
mov al, bl
sub dword [esp], eax
add dword [esp + 4], eax
add dword [esp + 8], eax
xor edx, edx
mov dl, byte [esi + 0x1098]
mov ecx, dword [esp]
mov eax, esi
call fcn.00458888
mov ebx, eax
test bl, bl
ja 0x458c5c
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x458e18
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov eax, dword [ebx + 0x4c]
mov dword [esp], eax
xor esi, esi
jmp 0x458e34
movzx eax, cx
mov byte [ebx + eax + 0x56], 0
inc word [ebx + 0x54]
mov cx, word [ebx + 0x54]
movzx eax, cx
xor edx, edx
mov dl, byte [ebx + 0x1098]
mov edi, edx
xor edx, edx
div edi
test edx, edx
jne 0x458e28
xor ecx, ecx
mov cl, byte [ebx + 0x1098]
lea edx, [ebx + 0x1057]
lea eax, [ebx + esi + 0x56]
call fcn.0040295c
xor edx, edx
mov dl, byte [ebx + 0x1098]
dec edx
test dx, dx
jb 0x458e8b
inc edx
xor eax, eax
movzx edi, ax
mov ecx, dword [ebx + 0x34]
mov cl, byte [ecx + edi]
xor byte [ebx + edi + 0x1057], cl
inc eax
dec dx
jne 0x458e75
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x30]
xor ecx, ecx
mov cl, byte [ebx + 0x1098]
mov edx, dword [ebx + 0x34]
lea eax, [ebx + 0x1057]
call fcn.0040295c
mov eax, dword [esp]
lea edx, [eax + esi]
xor ecx, ecx
mov cl, byte [ebx + 0x1098]
lea eax, [ebx + 0x1057]
call fcn.0040295c
xor eax, eax
mov al, byte [ebx + 0x1098]
add esi, eax
movzx eax, word [ebx + 0x54]
cmp esi, eax
jne 0x458e4d
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x458edc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov eax, dword [ebx + 0x4c]
mov dword [esp], eax
xor esi, esi
jmp 0x458ef8
movzx eax, cx
mov byte [ebx + eax + 0x56], 0
inc word [ebx + 0x54]
mov cx, word [ebx + 0x54]
movzx eax, cx
xor edx, edx
mov dl, byte [ebx + 0x1098]
mov edi, edx
xor edx, edx
div edi
test edx, edx
jne 0x458eec
xor ecx, ecx
mov cl, byte [ebx + 0x1098]
lea edx, [ebx + 0x1057]
lea eax, [ebx + esi + 0x56]
call fcn.0040295c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x34]
xor edx, edx
mov dl, byte [ebx + 0x1098]
dec edx
test dx, dx
jb 0x458f56
inc edx
xor eax, eax
movzx edi, ax
mov ecx, dword [ebx + 0x34]
mov cl, byte [ecx + edi]
xor byte [ebx + edi + 0x1057], cl
inc eax
dec dx
jne 0x458f40
xor ecx, ecx
mov cl, byte [ebx + 0x1098]
mov edx, dword [ebx + 0x34]
lea eax, [ebx + esi + 0x56]
call fcn.0040295c
mov eax, dword [esp]
lea edx, [eax + esi]
xor ecx, ecx
mov cl, byte [ebx + 0x1098]
lea eax, [ebx + 0x1057]
call fcn.0040295c
xor eax, eax
mov al, byte [ebx + 0x1098]
add esi, eax
movzx eax, word [ebx + 0x54]
cmp esi, eax
jne 0x458f11
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x45924c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, eax
mov eax, dword [esi + 0x38]
call fcn.00404a94
test eax, eax
je 0x4593df
mov eax, dword [esi + 0x38]
call fcn.00404a94
inc eax
call fcn.004095d0
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x4593d8
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [esi + 0x38]
mov eax, dword [ebp - 0x14]
call fcn.00409448
xor ebx, ebx
xor edi, edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov al, byte [eax + ebx]
mov byte [ebp - 0xd], al
mov eax, dword [esi + 0x38]
call fcn.00404a94
push eax
lea eax, [ebx + 1]
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [ebp - 0x14]
mov al, byte [eax + edx]
mov byte [ebp - 0xe], al
mov eax, dword [esi + 0x38]
call fcn.00404a94
push eax
lea eax, [ebx + 2]
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [ebp - 0x14]
mov al, byte [eax + edx]
mov byte [ebp - 0xf], al
mov eax, dword [esi + 0x38]
call fcn.00404a94
push eax
lea eax, [ebx + 3]
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [ebp - 0x14]
mov al, byte [eax + edx]
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x109c]
mov edx, dword [ebp - 4]
xor dword [eax + edi*4], edx
mov eax, dword [esi + 0x38]
call fcn.00404a94
push eax
lea eax, [ebx + 4]
pop edx
mov ecx, edx
cdq
idiv ecx
mov ebx, edx
inc edi
cmp edi, 0x12
jne 0x459295
mov eax, dword [esi + 0x38]
call fcn.00404a94
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
call fcn.004031a4
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
mov dword [esi + 0x10a4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
mov dword [esi + 0x10a8], eax
xor edi, edi
mov eax, esi
call fcn.004593e8
mov eax, dword [esi + 0x109c]
mov edx, dword [ebp - 8]
mov dword [eax + edi*4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + edi*4 + 4], edx
add edi, 2
cmp edi, 0x12
jl 0x459356
xor ebx, ebx
xor edi, edi
cmp ebx, 0x100
jge 0x4593ba
mov eax, esi
call fcn.004593e8
mov eax, edi
shl eax, 7
mov edx, dword [esi + 0x10a0]
lea edx, [edx + eax*8]
mov ecx, dword [ebp - 8]
mov dword [edx + ebx*4], ecx
mov edx, dword [esi + 0x10a0]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 0xc]
mov dword [eax + ebx*4 + 4], edx
add ebx, 2
cmp ebx, 0x100
jl 0x459384
xor ebx, ebx
inc edi
cmp edi, 4
jne 0x45937c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4593df
mov eax, dword [ebp - 0x14]
call fcn.0040961c
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x459a58
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffd8
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 0xc]
push eax
push 0x459ab4
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push 7
call sub.user32.dll_ExitWindowsEx
add esp, 0x28
ret
Function at 0x459d1c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, eax
xor esi, esi
lea eax, [esp + 0x10]
xor ecx, ecx
mov edx, 0x44
call fcn.004031a4
mov dword [esp + 0x10], 0x44
mov dword [esp + 0x3c], 1
mov word [esp + 0x40], 5
mov ebx, 0x820
push esp
lea eax, [esp + 0x14]
push eax
push 0
push 0
push ebx
push 0
push 0
push 0
mov eax, edi
call fcn.00404c8c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x459d79
mov esi, dword [esp]
mov eax, esi
add esp, 0x54
pop edi
pop esi
pop ebx
ret

Function at 0x460d9c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x460e00
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404a44
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408e64
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460e07
lea eax, [ebp - 0xc]
call fcn.004047dc
ret

Function at 0x463d48
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x463d80]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x463d5e
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x463d6d
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x463d7c
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x466f70
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x466f9e
mov eax, ebx
call fcn.00467a28
cmp dword [ebx + 0x3c], 0
je 0x466f97
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x46700f
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x467001
cmp dword [ebx + 8], 0
je 0x466fc0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x466fd2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x467001
cmp dword [ebx + 8], 0
je 0x466fb3
cmp eax, 3
je 0x466fe5
dec eax
jne 0x466fb3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x466fb3
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x466fb3
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x46702d
cmp dword [ebx + 0x10], 0xcc
je 0x46702d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00467038
pop ebx
ret
Function at 0x47efa4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x47ecac
call fcn.00406c84
xor eax, eax
push ebp
push 0x47f0e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x454dc4]
call fcn.00454e94
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00454f34
mov cl, 1
mov edx, 0x47f0fc
mov eax, ebx
call fcn.00454f9c
lea ecx, [ebp - 0x14]
mov edx, 0x47f160
mov eax, ebx
call fcn.00455598
mov edx, dword [ebp - 0x14]
mov eax, 0x483f04
call fcn.00404830
lea ecx, [ebp - 0x18]
mov edx, 0x47f174
mov eax, ebx
call fcn.00455598
mov edx, dword [ebp - 0x18]
mov eax, 0x483f08
call fcn.00404830
mov eax, dword [0x483f04]
mov edx, 0x47f188
call fcn.00404bd8
jbe 0x47f068
push 0
push 0x47f18c
push 0x47f18c
mov eax, dword [0x483f08]
call fcn.00404c8c
push eax
push 0x47f190
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
call fcn.004039d0
jmp 0x47f0c9
push 0x47f198
push 0
push 0
call fcn.00406e18
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x47f0c9
test ebx, ebx
je 0x47f0c9
mov eax, dword [0x482cc4]
mov eax, dword [eax]
call fcn.00453800
mov eax, dword [0x482cc4]
mov eax, dword [eax]
mov byte [eax + 0x5b], 0
mov ecx, dword [0x482c08]
mov eax, dword [0x482cc4]
mov eax, dword [eax]
mov edx, dword [0x47e3ac]
call fcn.00453818
mov eax, dword [0x482cc4]
mov eax, dword [eax]
call fcn.00453898
push ebx
call sub.kernel32.dll_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f0eb
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404800
ret