joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420cd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x420d80
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x4669d4], bl
mov eax, 0x4669d8
mov edx, esi
call fcn.004046d4
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x18]
xor edx, edx
mov dl, bl
mov eax, dword [0x41fff4]
call fcn.00411834
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x420d98
call fcn.00409748
push 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0041ce18
mov eax, dword [ebp - 4]
call fcn.00404b5c
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420d87
lea eax, [ebp - 0x18]
call fcn.00404680
lea eax, [ebp - 4]
call fcn.00404680
ret

Function at 0x420ed0
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
add esp, 0xffffffac
test al, al
je 0x420f1c
push esp
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [esp + 0x44]
xor ecx, ecx
mov edx, 0x10
call fcn.00403090
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 4]
push eax
mov eax, dword [0x4669c8]
call fcn.00404b5c
push eax
push 0
push 0x220
push 0
push 0
push 0
call sub.kernel32.dll_GetCommandLineA_1
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 1
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
add esp, 0x54
ret
Function at 0x4210bc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x421234
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x420094]
call fcn.00420f64
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x421217
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp word [ebp - 4], 0x5a4d
jne 0x421201
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.00416aa4
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp dword [ebp - 8], 0
je 0x421201
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.00416aa4
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp dword [ebp - 0xc], 0x4550
jne 0x421201
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
test byte [ebp - 0x15], 0x20
je 0x4211fd
push 2
push 0
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.00420fac
mov eax, dword [ebp - 0x2c]
call fcn.00404b5c
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4211f6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x421244
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x4211db
push 0xa
push 0x421250
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x4211db
mov byte [ebp - 1], 2
jmp 0x4211df
mov byte [ebp - 1], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421201
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42121e
mov eax, dword [ebp - 0x10]
call fcn.004037e0
ret

Function at 0x42132c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7fc
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x4213db
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4213b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404b5c
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00404b5c
push eax
mov eax, esi
call fcn.00404b5c
push eax
mov eax, ebx
call fcn.00404b5c
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x804]
mov eax, dword [ebp + 8]
call fcn.00404770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4213c5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4213e2
lea eax, [ebp - 4]
call fcn.00404680
ret
Function at 0x421fac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov edx, esp
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
xor edx, edx
mov dl, byte [esp]
mov eax, ebx
call fcn.00402bbc
xor ecx, ecx
mov cl, byte [esp]
lea edx, [ebx + 1]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0xc]
xor edx, edx
mov dl, byte [ebx]
test edx, edx
jle 0x421fef
lea eax, [ebx + 1]
xor byte [eax], 0x62
inc eax
dec edx
jne 0x421fe8
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x423db0
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x423d78
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret
Function at 0x424984
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x80c], ecx
mov esi, edx
lea edi, [ebp - 0x808]
mov ecx, 0x201
rep movsd dword es:[edi], dword [esi]
mov esi, eax
xor eax, eax
push ebp
push 0x424a3f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x80c]
mov ecx, esi
mov edx, 0x424a58
call fcn.004049a8
mov eax, dword [ebp - 0x80c]
call fcn.00404b5c
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x424a26
push 0
lea eax, [ebp - 4]
push eax
push 0x804
lea eax, [ebp - 0x808]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x424a1a
cmp dword [ebp - 4], 0x804
je 0x424a1e
xor ebx, ebx
jmp 0x424a20
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424a46
lea eax, [ebp - 0x80c]
call fcn.00404680
ret

Function at 0x4268f0
Capabilities:
Query environment variable

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, eax
push 0x800
lea eax, [esp + 4]
push eax
mov eax, dword [ebx]
call fcn.00404b5c
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov edx, esp
mov ecx, ebx
xchg ecx, eax
call fcn.00404770
add esp, 0x800
pop ebx
ret
Function at 0x427d64
Capabilities:
Create process on windows
Create process suspended
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
mov eax, dword [ebp - 8]
call fcn.00404b4c
mov eax, dword [ebp - 0xc]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x427f83
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
mov edx, 0x427f9c
mov eax, 0x80000000
call fcn.0041cd0c
lea eax, [ebp - 0x10]
call fcn.004268f0
lea eax, [ebp - 0x70]
push eax
xor ecx, ecx
mov edx, 0x427fc0
mov eax, dword [ebp - 0xc]
call fcn.004206d0
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0xc]
call fcn.00404718
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403090
lea eax, [ebp - 0x6c]
xor ecx, ecx
mov edx, 0x10
call fcn.00403090
mov dword [ebp - 0x5c], 0x44
call fcn.00427c04
test al, al
jne 0x427e2e
lea eax, [ebp - 0x18]
call fcn.00404680
jmp 0x427e41
lea eax, [ebp - 0x18]
mov ecx, dword [0x4669c0]
mov edx, 0x427fcc
call fcn.004049a8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x74]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x8c], eax
mov byte [ebp - 0x88], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x80], 0xb
lea eax, [ebp - 0x90]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.004049a8
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x7c], eax
mov byte [ebp - 0x78], 0xb
lea edx, [ebp - 0x8c]
mov ecx, 2
mov eax, 0x427fdc
call fcn.00409748
mov ecx, dword [ebp - 0x74]
mov edx, 0x428004
mov eax, dword [ebp - 0x10]
call fcn.004206d0
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00404b5c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x427f2e
push 0x2710
mov eax, dword [ebp - 0x6c]
push eax
call sub.user32.dll_WaitForInputIdle
push 0x7d0
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 0x64]
call fcn.00423db0
mov esi, eax
test esi, esi
je 0x427f1a
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call sub.user32.dll_SetWindowPos
push 3
push esi
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x427f4b
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x94]
call fcn.0040bbe0
mov edx, dword [ebp - 0x94]
mov al, 4
call fcn.00420cd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427f8a
lea eax, [ebp - 0x94]
mov edx, 2
call fcn.004046a4
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004046a4
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004046a4
ret
Function at 0x428368
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
mov eax, dword [0x466934]
test byte [eax + 0x25], 0x10
je 0x4283aa
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.004048f0
jmp 0x4283b1
mov eax, ebx
call fcn.00404680
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428518
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], edx
mov esi, eax
xor eax, eax
push ebp
push 0x428692
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x466934]
test byte [eax + 0x24], 4
je 0x428670
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x18]
mov eax, dword [0x4650d8]
mov eax, dword [eax]
call fcn.00420fac
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404b5c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jbe 0x428667
mov eax, ebx
call fcn.0040271c
mov edi, eax
push edi
push ebx
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404b5c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x428655
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4286a0
push edi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x42864c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
call fcn.004072b4
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0xc]
mov ax, word [eax + 8]
mov word [ebp - 0x10], ax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
call fcn.004072b4
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0xc]
mov ax, word [eax + 0xc]
mov word [ebp - 0x14], ax
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0xe]
call fcn.004087f4
push dword [ebp - 0x1c]
push 0x4286ac
lea edx, [ebp - 0x20]
movzx eax, word [ebp - 0x10]
call fcn.004087f4
push dword [ebp - 0x20]
push 0x4286ac
lea edx, [ebp - 0x24]
movzx eax, word [ebp - 0x12]
call fcn.004087f4
push dword [ebp - 0x24]
push 0x4286ac
lea edx, [ebp - 0x28]
movzx eax, word [ebp - 0x14]
call fcn.004087f4
push dword [ebp - 0x28]
mov eax, esi
mov edx, 7
call fcn.00404a1c
jmp 0x42865c
mov eax, esi
call fcn.00404680
jmp 0x42865c
mov eax, esi
call fcn.00404680
mov edx, ebx
mov eax, edi
call fcn.0040273c
jmp 0x428677
mov eax, esi
call fcn.00404680
jmp 0x428677
mov eax, esi
call fcn.00404680
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428699
lea eax, [ebp - 0x28]
mov edx, 5
call fcn.004046a4
ret
Function at 0x428d80
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x428e08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x466934]
test byte [eax + 0x25], 0x20
je 0x428deb
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fdiv dword [0x428e14]
call fcn.00402bd8
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.004088e0
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x428e20
call fcn.004049a8
jmp 0x428df2
mov eax, ebx
call fcn.00404680
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428e0f
lea eax, [ebp - 0x24]
call fcn.00404680
ret

Function at 0x428e24
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x428eac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x466934]
test byte [eax + 0x25], 0x40
je 0x428e8f
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fdiv dword [0x428eb8]
call fcn.00402bd8
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.004088e0
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x428ec4
call fcn.004049a8
jmp 0x428e96
mov eax, ebx
call fcn.00404680
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428eb3
lea eax, [ebp - 0x24]
call fcn.00404680
ret
Function at 0x429140
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x429291
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov eax, dword [0x4650d8]
mov eax, dword [eax]
call fcn.00420fac
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404b5c
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jbe 0x42926e
mov eax, ebx
call fcn.0040271c
mov esi, eax
push esi
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x42925b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4292a0
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x429251
push 0x4292c4
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
mov edx, 4
call fcn.00408908
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.00408908
push dword [ebp - 0x20]
push 0x4292e0
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404a1c
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404b5c
push eax
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x429263
cmp dword [ebp - 0xc], 1
jbe 0x429263
mov eax, dword [ebp - 0x10]
call fcn.0040906c
mov ecx, eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00404770
jmp 0x429263
mov eax, dword [ebp - 4]
call fcn.00404680
jmp 0x429263
mov eax, dword [ebp - 4]
call fcn.00404680
mov edx, ebx
mov eax, esi
call fcn.0040273c
jmp 0x429276
mov eax, dword [ebp - 4]
call fcn.00404680
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429298
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004046a4
ret
Function at 0x42b6a4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, eax
mov ebx, pe_nt_image_headers32
push ebx
lea eax, [esp + 4]
push eax
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x42b6d8
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004048f0
jmp 0x42b6df
mov eax, esi
call fcn.00404680
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x42dc24
Capabilities:
Terminate thread

Disassembly:
call fcn.0041d46c
test al, al
jne 0x42dc88
cmp dword [0x4669a0], 0
je 0x42dc88
mov eax, dword [0x464fc4]
cmp byte [eax], 0
jne 0x42dc5c
mov eax, dword [0x4669a0]
call fcn.0041acb0
push 0xffffffffffffffff
mov eax, dword [0x4669a0]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x42dc6c
push 1
mov eax, dword [0x4669a0]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [0x4669a0]
call fcn.004037e0
mov eax, dword [0x4669a4]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [0x4669a0], eax
ret

Function at 0x42de60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
lea edi, [ebp - 8]
call fcn.00421260
mov edx, dword [eax]
mov dword [edi], edx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ebx, dword [edi]
dec ebx
jmp 0x42de81
dec ebx
test ebx, ebx
jl 0x42de8e
mov eax, dword [edi + 4]
cmp dword [eax + ebx*8], 0
je 0x42de80
mov esi, dword [edi + 4]
mov eax, dword [esi + ebx*8]
test eax, eax
je 0x42decd
mov dword [0x466958], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
lea eax, [esi + ebx*8]
call fcn.0042dd1c
push eax
call sub.kernel32.dll_VirtualProtect
lea eax, [esi + ebx*8]
call fcn.0042dd1c
mov dword [0x466980], eax
mov eax, 0x42de34
mov edx, dword [0x466980]
mov dword [edx], eax
mov ebx, dword [edi]
dec ebx
jmp 0x42ded3
dec ebx
test ebx, ebx
jl 0x42dee1
mov eax, dword [edi + 4]
cmp dword [eax + ebx*8 + 4], 0
je 0x42ded2
mov esi, dword [edi + 4]
mov eax, dword [esi + ebx*8 + 4]
test eax, eax
je 0x42df11
mov dword [0x46695c], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
lea eax, [esi + ebx*8 + 4]
call fcn.0042dd1c
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, 0x42de50
mov dword [esi + ebx*8 + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42fc98
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42fc9e
ret
Function at 0x4320e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x432131
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x432118
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x432108
jmp 0x432131
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x432119
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b67c
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x43b5c8
call sub.user32.dll_EnumWindows
ret

Function at 0x43b79c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x43b819
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0043b1fc
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x43b7c1
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0043adfc
cmp dword [ebp - 4], 0
je 0x43b803
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404b5c
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b820
lea eax, [ebp - 4]
call fcn.00404680
ret

Function at 0x43e4bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x466ee4], 0
je 0x43e60b
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x465244]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x43e60b
mov eax, dword [0x466ee8]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x466ee4]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x43e5da
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x466ee4]
call fcn.00414b84
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x43e5d2
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x43e5d2
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x43e5d2
mov eax, dword [ebp - 0x14]
call fcn.00447020
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43e5d2
push ebp
call fcn.0043e478
pop ecx
test al, al
jne 0x43e5d2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x43e58e
mov eax, dword [ebp - 0x14]
call fcn.00445b50
dec eax
jle 0x43e5d2
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004039dc
cmp byte [ebp - 1], 0
je 0x43e5d2
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x43e5d2
mov edx, dword [ebp - 0x14]
mov eax, dword [0x466ee8]
call fcn.0043dc44
inc edi
dec ebx
jne 0x43e521
mov eax, dword [0x466ee8]
cmp dword [eax + 8], 0
jle 0x43e5f2
mov eax, dword [0x466ee8]
call fcn.0043dcd4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43e60b
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0043e2e0
pop ecx
test al, al
jne 0x43e60b
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret