joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485500
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x48552f
push str.Couldnt_set_desired_mode
push edx
call fcn.00467c40
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebp
ret
cmp ecx, 0xc8
je 0x485546
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.00467d20
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x48555d
push edi
call fcn.00485260
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x14
jne 0x485571
push edi
call fcn.004842b0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x15
jne 0x485585
push edi
call fcn.00485240
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x16
jne 0x485595
push edi
call fcn.004853e0
mov esi, eax
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x499720
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x64b024]
mov edi, eax
add esp, 4
test edi, edi
jne 0x49974d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x499797
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 0x10], ebx
jmp 0x49979d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4997fb
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop dword [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x4997c0
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x499827
mov eax, dword [esi + 4]
push 1
push 0x5dd866
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x5dd867
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x499800
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x505a00
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
xor ebp, ebp
push esi
test eax, eax
je 0x505a18
test byte [eax + 0x5c], 2
mov ebx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x505a1d
mov ebx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x505ae6
mov edx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
inc edi
movzx eax, byte [edi - 1]
cmp esi, 3
jl 0x505a80
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
mov ecx, eax
shr ecx, 6
add edx, 2
and ecx, 0x3f
and eax, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov cl, byte [eax + ebx]
jmp 0x505ac3
shl eax, 0x10
cmp esi, 2
jne 0x505a90
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
add edx, 2
cmp esi, 1
jne 0x505ab6
mov al, 0x3d
jmp 0x505abf
shr eax, 6
and eax, 0x3f
mov al, byte [eax + ebx]
mov byte [edx], al
mov cl, 0x3d
lea eax, [edx + 1]
sub esi, 3
lea edx, [eax + 1]
mov byte [eax], cl
add ebp, 4
add edi, 3
test esi, esi
jg 0x505a33
pop edi
pop esi
mov eax, ebp
mov byte [edx], 0
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
pop esi
mov byte [eax], 0
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x513bb0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x9c
call fcn.005cf5c0
mov eax, dword [0x64b00c]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0xb0]
push ebx
mov ebx, dword [esp + 0xac]
push ebp
mov ebp, dword [esp + 0xac]
push esi
mov esi, dword [esp + 0xac]
push edi
mov edi, dword [esp + 0xbc]
mov dword [esp + 0x14], eax
mov eax, dword [esi]
mov dword [esp + 0x10], 0
test edi, edi
je 0x513c1d
cmp edi, eax
je 0x513c11
test ebp, ebp
je 0x513c90
test ebx, ebx
js 0x513c90
mov dword [esp + 0x10], 1
mov dword [esi], edi
jmp 0x513c23
test eax, eax
je 0x513c90
mov edi, eax
push edi
call fcn.004bcec0
add esp, 4
test al, 2
jne 0x513c90
test ebp, ebp
je 0x513d9b
push edi
mov dword [esp + 0x14], 1
call fcn.004bce40
add esp, 4
cmp eax, 0x90
jg 0x513c90
cmp eax, ebx
jge 0x513cab
push dword [esp + 0x14]
push edi
push dword [esi + 4]
call fcn.004a2010
add esp, 0xc
test eax, eax
je 0x513c90
push ebx
push ebp
push dword [esi + 4]
call fcn.004a2390
add esp, 0xc
test eax, eax
je 0x513c90
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.004a1ee0
add esp, 0xc
test eax, eax
jne 0x513cc7
xor eax, eax
mov ecx, dword [esp + 0xa8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00456b8b
add esp, 0x9c
ret
cmp ebx, 0x90
ja 0x513c90
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call fcn.005aed80
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x90
je 0x513cea
mov eax, 0x90
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call fcn.005aebe0
add esp, 0xc
mov ebx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x90
jl 0x513cf0
mov ebp, dword [esp + 0x14]
push ebp
push edi
push dword [esi + 8]
call fcn.004a2010
add esp, 0xc
test eax, eax
je 0x513da8
push edi
call fcn.004bce40
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.004a2390
add esp, 0x10
test eax, eax
je 0x513da8
xor ecx, ecx
nop dword [eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x90
jl 0x513d40
push ebp
push edi
push dword [esi + 0xc]
call fcn.004a2010
add esp, 0xc
test eax, eax
je 0x513da8
push edi
call fcn.004bce40
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.004a2390
add esp, 0x10
test eax, eax
je 0x513da8
push dword [esi + 8]
push dword [esi + 4]
call fcn.004a2420
xor ebp, ebp
add esp, 8
test eax, eax
mov ecx, 1
cmovne ebp, ecx
jmp 0x513daa
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x513d7f
jmp 0x513cee
xor ebp, ebp
test ebx, ebx
je 0x513dc0
lea eax, [esp + 0x18]
push 0x90
push eax
call fcn.00401320
add esp, 8
mov eax, ebp
jmp 0x513c92

Function at 0x5c86c2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005c8533
Function at 0x65abf0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x65ad52
cmp edi, esi
je 0x65ad52
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x65ad42
add edi, 4
jmp 0x65aca3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x65acb8
mov dword [ebp - 4], 2
jmp 0x65acd9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x65accf
mov dword [ebp - 4], 1
jmp 0x65acd9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x65ad52
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x65ad10
mov byte [ecx + 2], 0x3d
jmp 0x65ad1d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x65ad2c
mov byte [ecx], 0x3d
jmp 0x65ad32
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x65aca0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1b5121b
Capabilities:
Parse pe header

Disassembly:
push edx
movzx dx, dl
cmovbe dx, di
not dh
cdq
jmp 0x73a254
mov esp, ebp
xchg ebp, ebp
pop ebp
jmp 0x70a327
jne 0x1b36e57
test dword [ebp - 0x126], 0x2000
jmp loc.004527f1
je 0x1b36e57
cmp dword [ebp - 0x13c], 0x4550
jmp 0x6c3bff
ret 4
call fcn.0065c830
test al, al
jmp 0x1334932
push edx
movsx edx, cx
bswap dx
movzx dx, dh
push eax
movzx eax, bp
cdq
push edi
mov edx, 0xf8
movsx eax, si
lahf
mov eax, esi
jmp 0x74e5ee
call fcn.0065c830
test al, al
jmp 0x6d0052
je 0x1b36e57
mov ecx, 0x5a4d
cmp word [ebp - 0x44], cx
jmp 0x1b922bf
pop edi
cbw
jmp 0x1b8e874
push ebp
shrd edx, edx, 0
sal ebp, 0x1c
mov ebp, esp
sal dx, cl
setnp dh
add dl, 0x36
sub esp, 0x13c
mov dh, dh
mov edx, 0x4a4253e8
push esi
push edi
cdq
mov esi, eax
cwd
lea eax, [ebp - 0x44]
jmp 0x1b5ae60
push eax
cmovg eax, edi
rdtsc
push 0
movzx eax, ax
movsx edx, ax
mov edi, ecx
push 0
cdq
movzx edx, di
setnp dh
push edi
cmovns eax, ebp
xchg edx, eax
movzx edx, sp
mov edx, 0x40
mov eax, esi
jmp 0x736fb1
je 0x1b36e57
lea edx, [ebp - 0x13c]
jmp 0x664548
mov eax, 0xc000007b
not si
pop esi
jmp 0x69acb0
jne 0x1b36e57
mov eax, dword [ebp - 8]
cmp eax, 0x55d06269
test al, 0x21
test eax, eax
jmp 0x1b70d54
Function at 0x10048e98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10048ea7
pop dword [ebp - 0x3c]
mov eax, 0x10048ea7
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x8882c522
sub dword [ebp - 0x4c], 0x3a307fd7
mov dword [ebp - 0x48], 0x72ddce28
add dword [ebp - 0x48], 0xbf557e1d
mov dword [ebp - 0x44], 0x99a9bfc6
sub dword [ebp - 0x44], 0x4d5d7b98
mov dword [ebp - 0x40], 0x2f3d3118
sub dword [ebp - 0x40], 0x2f3d3118
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xf8cf66b2
add eax, 0x1736995e
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x380946fe
sub dword [ebp - 0x4c], 0xc396dda8
mov dword [ebp - 0x48], 0x6f048ccd
sub dword [ebp - 0x48], 0x2d982b58
mov dword [ebp - 0x44], 0x8610fc9f
add dword [ebp - 0x44], 0xdd5e6fcd
mov dword [ebp - 0x40], 0xb082849e
add dword [ebp - 0x40], 0x4f7d7b62
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x71c17eae
sub eax, 0x61bb7e9a
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x55ac8
push 0
call eax
mov ecx, 0x4764
xor edi, edi
add edi, eax
mov edx, 0xed3d5b5a
add edx, 0x22cb60a6
add edx, dword [ebp - 0x3c]
mov esi, 0x9085f0eb
sub esi, 0xf554c215
xor dword [ebp - 4], 0xb93284af
mov ebx, dword [edx]
add ebx, esi
sub dword [ebp - 0x20], ebx
mov dword [edi], ebx
sub dword [ebp - 0x10], ecx
add edi, 0x66a621ee
sub edi, 0x66a621ea
add edx, 4
loop 0x10048fc0
add eax, 0xdcd4aa1d
sub eax, 0xdcd399ba
mov ebx, eax
add eax, 0x4c26b82b
add eax, 0xb3d947da
mov ecx, 0x10000000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x405968
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4059ce
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404080
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b14
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4059b8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4059d5
lea eax, [ebp - 0x10]
call fcn.00403e10
ret

Function at 0x40a8e8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a921
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f00
jmp 0x40a92a
mov eax, ebx
mov edx, esi
call fcn.00403e64
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a934
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a955
mov al, byte [esp]
jmp 0x40a957
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40afdc
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ae54
mov eax, dword [0x452084]
cmp byte [eax], 0
je 0x40b058
mov eax, dword [0x451ea4]
call fcn.00402980
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040815c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b0a0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b08e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x451e54]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x453664]
call fcn.00404e7c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40b8f4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b9ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403ea8
lea eax, [ebp - 8]
call fcn.00404320
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004042d0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40b9b4
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40b9ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004042d0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40b997
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40b9dc
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40b997
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b9b4
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b9d1
lea eax, [ebp - 8]
call fcn.00403e10
ret

Function at 0x40be48
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40beac
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404080
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407cec
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40beb3
lea eax, [ebp - 0xc]
call fcn.00403e10
ret

Function at 0x419ff0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x453884
cmp dword [edi], 0
jne 0x41a06c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x453880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4513ec
mov ecx, 2
call fcn.004028b8
mov edx, 0x419fc8
lea eax, [esi + 5]
call fcn.00419fe8
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00419fe8
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a041
mov dword [0x453880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41b288
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41b28e
ret
Function at 0x41d718
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41d769
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41d750
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41d740
jmp 0x41d769
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41d751
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a080
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x429fcc
call sub.user32.dll_EnumWindows
ret

Function at 0x42a1a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x42a21d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00429c00
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x42a1c5
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00429800
cmp dword [ebp - 4], 0
je 0x42a207
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004042d0
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a224
lea eax, [ebp - 4]
call fcn.00403e10
ret

Function at 0x42d228
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x453b54], 0
je 0x42d377
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x452028]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x42d377
mov eax, dword [0x453b58]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x453b54]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x42d346
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x453b54]
call fcn.00413558
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x42d33e
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x42d33e
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x42d33e
mov eax, dword [ebp - 0x14]
call fcn.00435eb0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42d33e
push ebp
call fcn.0042d1e4
pop ecx
test al, al
jne 0x42d33e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x42d2fa
mov eax, dword [ebp - 0x14]
call fcn.004349e0
dec eax
jle 0x42d33e
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004032d4
cmp byte [ebp - 1], 0
je 0x42d33e
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x42d33e
mov edx, dword [ebp - 0x14]
mov eax, dword [0x453b58]
call fcn.0042c9b0
inc edi
dec ebx
jne 0x42d28d
mov eax, dword [0x453b58]
cmp dword [eax + 8], 0
jle 0x42d35e
mov eax, dword [0x453b58]
call fcn.0042ca40
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42d377
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0042d04c
pop ecx
test al, al
jne 0x42d377
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430948
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x430994
mov eax, esi
call fcn.004463c4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x430994
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x430994
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x430ad3
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x4309d4
cmp eax, 0x108
ja 0x4309d4
mov eax, esi
call fcn.004463c4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x430aca
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x430ad3
jmp 0x430aca
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x430ab3
cmp eax, 0x20a
ja 0x430ab3
test byte [esi + 0x50], 0x80
jne 0x430a06
sub eax, 0x203
je 0x430a03
sub eax, 3
je 0x430a03
sub eax, 3
jne 0x430a06
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x430a1a
dec eax
je 0x430a2f
dec eax
je 0x430a4c
dec eax
je 0x430a2f
jmp 0x430a53
mov ecx, ebx
mov eax, dword [0x452028]
mov eax, dword [eax]
mov edx, esi
call fcn.0044fb70
jmp 0x430aca
cmp byte [esi + 0x5d], 1
jne 0x430a45
mov eax, esi
mov si, 0xffed
call fcn.004032d4
jmp 0x430ad3
or word [esi + 0x54], 1
jmp 0x430aca
and word [esi + 0x54], 0xfffe
jmp 0x430aca
mov eax, dword [0x453b10]
cmp byte [eax + 0x20], 0
je 0x430aca
mov eax, dword [0x453b10]
cmp dword [eax + 0x1c], 0
je 0x430aca
mov eax, dword [ebx]
mov edx, dword [0x453b10]
cmp eax, dword [edx + 0x1c]
jne 0x430aca
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00446308
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.004032d4
jmp 0x430ad3
cmp eax, 0xb00b
jne 0x430aca
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0042f278
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret