joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4222e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
lea eax, [edi + 1]
mov dword [esi + 8], edi
call fcn.00402650
mov dword [esi], eax
cmp eax, edi
je 0x42230b
push 0x429b92
push eax
call dword [0x6300bc]
mov esi, dword [0x62fa98]
xor eax, eax
cmp byte [esi], al
je 0x42231e
inc eax
cmp byte [esi + eax], 0
jne 0x422317
inc eax
call fcn.00402650
mov ebx, eax
mov dword [ebp - 0x10], ebx
cmp ebx, edi
je 0x422335
push esi
push ebx
call dword [0x6300bc]
lea eax, [ebp - 0x24]
push eax
call dword [0x62ffd0]
mov eax, dword [ebp - 0x16]
lea esi, [eax + eax*4]
mov word [0x62fe80], si
cmp dword [ebp + 0xc], edi
jle 0x4223a9
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx ecx, si
mov dword [ebp - 4], eax
lea esp, [esp]
mov eax, ecx
shr eax, 2
xor eax, ecx
shr eax, 1
xor eax, ecx
shr eax, 2
xor eax, ecx
and eax, 1
mov dword [0x62fe84], eax
shl eax, 0xf
shr si, 1
or si, ax
movzx ecx, si
xor edx, edx
mov ebx, 0xb
mov eax, ecx
div ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
inc edi
mov dl, byte [edx + ebx]
mov byte [eax + edi - 1], dl
cmp edi, dword [ebp + 0xc]
jl 0x422360
mov word [0x62fe80], si
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [ebp + 0xc]
mov byte [eax + ecx], 0
test ebx, ebx
je 0x422421
mov ecx, dword [ebx - 8]
lea eax, [ebx - 0x10]
mov dword [eax], 1
test ecx, ecx
je 0x4223f1
cmp dword [ecx], 0
je 0x4223f1
cmp dword [0x630120], ecx
jne 0x4223db
mov dword [0x630120], eax
mov esi, dword [ecx + 4]
add dword [eax + 4], esi
mov esi, dword [ecx + 8]
mov dword [eax + 8], esi
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x4223f1
mov dword [ecx + 0xc], eax
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x422421
cmp dword [ecx], 0
je 0x422421
cmp dword [0x630120], eax
jne 0x42240b
mov dword [0x630120], ecx
mov esi, dword [eax + 4]
add dword [ecx + 4], esi
mov esi, dword [eax + 8]
mov dword [ecx + 8], esi
mov eax, dword [eax + 8]
test eax, eax
je 0x422421
mov dword [eax + 0xc], ecx
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422ae0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x630068]
test esi, esi
jne 0x422af8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x422af1
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x422af1
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x422b5a
jmp 0x422b40
mov eax, dword [ebx + edi*4]
mov ecx, dword [0x62fbd8]
add eax, esi
call fcn.00422280
test eax, eax
je 0x422b63
inc edi
cmp edi, dword [ebp - 4]
jb 0x422b40
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42442a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e2b0]
jne 0x424434
repz ret
jmp fcn.00424d47

Function at 0x425bec
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00424439
and dword [ebp - 0x14], 0
cmp dword [0x42f754], 0
mov dword [ebp - 0x18], eax
jne 0x425c9f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x425d47
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x425d47
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42f754], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42f758], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42f75c], eax
call edi
push eax
call esi
mov dword [0x42f764], eax
test eax, eax
je 0x425c9f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42f760], eax
mov eax, dword [0x42f760]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x425cf8
cmp dword [0x42f764], ecx
je 0x425cf8
push eax
call esi
push dword [0x42f764]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x425cf8
test ebx, ebx
je 0x425cf8
call edi
test eax, eax
je 0x425cef
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x425cef
test byte [ebp - 8], 1
jne 0x425cf8
or dword [ebp + 0x10], 0x200000
jmp 0x425d2b
mov eax, dword [0x42f758]
cmp eax, dword [ebp - 0x18]
je 0x425d2b
push eax
call esi
test eax, eax
je 0x425d2b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x425d2b
mov eax, dword [0x42f75c]
cmp eax, dword [ebp - 0x18]
je 0x425d2b
push eax
call esi
test eax, eax
je 0x425d2b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42f754]
call esi
test eax, eax
je 0x425d47
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x425d49
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042442a
leave
ret
Function at 0x40dc66
Capabilities:
Encode data using xor

Disassembly:
inc ebp
sbb bh, dh
out dx, eax
imul edi
dec esi
xor dword [edx - 0x1c], esi
jp 0x40dc68
xlatb
adc al, 0x69
aas
les edx, [eax + 0x10776557]
scasd eax, dword es:[edi]
rol eax, 1
push esp
aas
in eax, dx
shr dword [ebx - 0x21], 0x97
invalid

Function at 0x41395f
Capabilities:
Encode data using xor

Disassembly:
and byte [ebx - 0x6c803491], cl
mov al, 0x62
mov dword [0x902c1e1], eax
add cl, byte [ecx]
loopne 0x41396a
mov dword [0xb2c5ad8f], eax
mov dl, 0xb7
mov eax, 0xb3130346
sbb al, 0x89
push ebx
xor dword [eax - 0xa99b06f], ecx
xchg dl, al
xchg dl, al
out dx, al
cmp dword [eax + 0x557be34], 0xffffffb1
mov eax, dword [0x1f838eb3]
out dx, eax
pop esp
mov dh, 0x9d
out 0x5b, al
cwde
xor dh, byte [esi + edi*8 - 0x15eab93d]
adc eax, dword [ebx - 0x6387aea8]
test eax, 0xb81d5e67
jbe 0x413985
invalid

Function at 0x414194
Capabilities:
Encode data using xor

Disassembly:
fist word gs:[ecx]
invalid
dec ebp
enter 0xffffffffffffffec, 0x35
jb 0x4141c6
cmpsd dword ds:[esi], dword es:[edi]
mov bl, 0xb8
ret
pushal
sahf
test byte [ecx], dh
inc esp
dec ebp
loope 0x414160
xchg esi, eax
sub al, 0x99
mov ds, word [ebx + 0x37830304]
mov byte [ecx], 0xa3
aam 0xbe
and byte [ecx], 0x3f
and ch, byte [ecx + 0x1d3d01d8]
lahf
invalid

Function at 0x47d761
Capabilities:
Encode data using xor

Disassembly:
enter 0xffffffffffff8687, 0x2a
mov ds, word [esp + ecx*4]
stc
js 0x47d7c5
cmp dword [ecx - 0x4cb6a3c4], edx
jge 0x47d75a
mul byte [edx]
xlatb
jnp 0x47d7bc
mov word [ecx - 0x300c7648], gs
wait
inc edx
mov ebx, dword [eax - 0x75c74ac7]
xchg edi, eax
dec edx
movsd dword es:[edi], dword [esi]
scasb al, byte es:[edi]
add bh, byte [ebx]
xchg ecx, edx
nop
mov eax, 0x82145083
push ds
fcomp dword [ecx]
invalid
or eax, 0x2affa3b3
mov bh, 0x66
mov al, 0x68
pop es
xchg dword [ebx - 0x30e74374], ebx
outsb dx, byte [esi]
push ecx
xchg dword [edi - 0x5b], ebp
popfd
sbb byte [edi], 0x20
leave
mov al, 0xc8
push ebx
dec ecx
dec ebp
jl fcn.0047d761
adc ecx, dword [ebp - 0x78bf5a59]
mov ch, 0xdf
sbb al, 0xf6
daa
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
inc eax
xchg dword [ebp + 0x27f61cdf], esi
dec esi
push ss
inc edi
mov eax, dword ss:[0x8aceeeb]
jl 0x47d778
sub dword [eax + edx*2 + 0x6f1ca689], esp
rcl byte [edx + 0x5a667d0d], 0x5c
mov bl, 0xf2
xchg ebx, eax
fdivp st(6)
xchg esp, eax
je 0x47d7f8
aam 0xf1
ja 0x47d7a0
add eax, 0xc4e7a5bc
xchg edi, eax
test eax, 0x6ec6890d
bound eax, qword [eax - 0x40]
xchg dword [edi + 0x4df8aec], ebx
lahf
scasb al, byte es:[edi]
mov ecx, 0xa4e6dd35
lahf
pop ecx
jo 0x47d824
inc ebp
hlt
invalid
Function at 0x486b89
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x8cec6ae5
jnp 0x486a51
movsd dword es:[edi], dword [esi]
pop edi
pop ebp
push eax
std
sbb al, 0x98
mov eax, dword ss:[0x465a2024]
pop es
std
popfd
neg byte [edx]
rol edx, cl
dec ebp
xchg ebp, eax
cmc
add eax, 0x73c5d3f5
pop esi
jae 0x486a97
je 0x486a37
invalid
cmp al, 0x3f
xchg dword [edx], ebp
push esp
mov esi, 0x8d7fdcf3
cmp byte [ecx - 0x6bedce15], bl
mov ah, 0xd8
push edx
sti
or al, bl
add al, 0x3d
mov al, byte [ebp - 0x43]
mov dl, 0x9c
xor dword [ebx - 0x29], 0xffffffb5
iretd
mov ch, 0xcf
jo 0x486a6e
stc
movsb byte es:[edi], byte [esi]
jge 0x486a15
mov dword [0x9ebbe517], eax
lahf
or eax, ebx
add dl, byte [ebx + 0x59fdfc57]
jle 0x486a80
push 0xffffffffffffffba
lodsd eax, dword [esi]
xchg ecx, eax
xchg ecx, eax
ret 0x9bb
or dword [ecx], 0x937f5582
hlt
jo 0x486a74
or eax, 0x5432c8aa
adc eax, 0x6dafdda0
jg 0x486a71
imul esp, eax, 4
and dword [ebx - 0x43e6fb70], 0x9c60cf07
inc ebp
or dl, dh
retf
mov eax, dword [0xa33d1ee3]
push 0x46
jo 0x486ad5
push esp
out dx, eax
mov dl, 0xc6
mov al, 0x9c
pop ss
mov cl, 0xe7
xchg ebx, eax
mov dword [0x1b83a34e], eax
in al, dx
adc dword [ebp - 0x2a0cab59], 0xa6cfb09f
or eax, 0x7333aaa0
jecxz 0x486b9e
in eax, dx
int 0xf3
ficomp word [esi]
ret
clc
sub eax, 0xadb9ae13
jae 0x486b48
mov ah, byte [edi + edx*8 - 0x42]
loop 0x486b6b
int1
int3
cmp eax, 0x418eb3cc
ljmp 0x70c1

Function at 0x486d5c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xb66de77c
or edx, dword [edi + edx*4 + 0x620d31]
cli
dec ecx
invalid
Function at 0x4ae781
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
xchg ebx, eax
sub dword [ecx + 0x25], esi
add al, 9
lahf
and dword [eax - 0x376b6366], ebp
cmp ch, byte [eax + 0x4d186e18]
sbb ebp, dword [eax]
push edi
jo 0x4ae74e
pop es
movsb byte es:[edi], byte [esi]
pop edx
ja 0x4ae7aa
cmp eax, 0xdd2bba54
push esp
push eax
push esp
mov edx, 0x5054dd2b
jmp 0x78e32d88
jae 0x4ae7c6
rol dword [eax], cl
adc al, 0xdd
js 0x4ae751
adc ebx, ecx
mov bh, 0x29
inc edx
or al, 0xbd
enter 0x3d7e, 0xffffffffffffff80
sbb dh, bl
mov byte [bp + si], bl
add edx, ecx
mov dword [0x837ec19], eax
push ds
popfd
or byte [esp + ecx + 0x169b6b0d], dl
lahf
loopne 0x4ae7c8
push esi
wait
invalid
sbb byte [ecx], ah
fstp dword [ebx + 0x34]
jo 0x4ae76c
movsb byte es:[edi], byte [esi]
cli
mov edi, 0x7fc0948
sbb ebp, dword [eax + 0x62]
insd dword es:[edi], dx
in al, dx
sbb ebp, dword [ebp - 0x36379606]
aam 0x19
adc eax, 0x7323fc0f
neg edi
mov ecx, 0xf43de7b8
mov eax, 0x1d542d62
cmp al, 0x56
cdq
xchg edx, eax
mov ch, 0x30
push ss
mov eax, ebp
jae 0x4ae85f
lodsb al, byte [esi]
mov ecx, 0x1ff659a8
mov ecx, 0x20b34d08
jbe 0x4ae80c
inc dword [esp + ebp*4 - 0x220ee26b]
fnstsw word [0xffff9de6]
test byte [ebp + edx*4 + 0x67ddf11d], ch
fnstsw word [esi]
out 0x9d, al
mov esi, 0xfe38ab70
insb byte es:[edi], dx
dec esp
movsd dword es:[edi], dword [esi]
lcall 0x8ca1, 0x976a8a1b
adc al, 0x59
invalid
xchg esp, eax
xchg esi, eax
and dword [eax - 0x6f826346], esi
sub dword [ebx - 0x7dc08aa6], ebx
cmp edi, dword [edx]
xchg edx, eax
bound ebx, qword [ecx]
push ebp
fistp qword [edx]
inc esp
dec edx
push 0x35f511cd
imul edi, dword [ecx - 0x3c], 0x985cc7a9
mov al, 0xc9
xor eax, 0xa9c47969
invalid
mov al, 0xc9
dec ecx
fisttp dword [edx + 0x40174d26]
mov ebp, 0x709d8d72
pushal
inc eax
xor byte [eax], dh
pop edi
xchg ebp, eax
jg 0x4ae87b
test byte [eax], ch
or byte [edx], bl
sti
stosb byte es:[edi], al
pop ds
wait
push 0x62
sbb byte [ebx - 0x29fe6661], ch
test eax, 0x714ebd0
test dword [ecx - 0x50], eax
jle 0x4ae8f4
add byte [ecx], 0xa
nop
in eax, 0x81
sub dl, bl
and al, 0xd8
fisub dword [eax + ebx*8]
insb byte es:[di], dx
xchg byte [edi + 0x583d4492], ch
pop edx
or byte [eax], ch
jp 0x4ae884
pop esp
adc byte [ecx + 0x73191e38], dl
cli
int1
inc ebx
js 0x4ae8ec
jns 0x4ae8bc
inc esp
js 0x4ae8bd
test dword [edx], edx
mov eax, dword [0x3d8f1ff1]
dec eax
shr byte [ecx - 0x576d0668], 1
adc ecx, dword [edi - 0x6067e4a0]
lahf
or edx, dword [esi]
push ss
cmp ecx, dword [ebp + 0xd98acb]
mov bl, byte [edi + ecx*2 + 0x237e2c18]
pop eax
sbb dword [ecx - 0x72f574d8], edi
bsf esi, dword [ebp - 0x5a]
xor byte [0x33afe2f9], bl
cmc
and byte [edi + esi - 0x717461b1], ch
invalid
Function at 0x4b3658
Capabilities:
Encode data using xor

Disassembly:
sbb byte [0x4d986d98], cl
fld dword [ecx]
fadd dword [ebp + 0x1498ef79]
test dword [ecx - 0x11], edi
cwde
adc al, 0xb5
invalid
xor byte [ebp + 0x5b], cl
daa
sub dh, byte [ecx]
cmp cl, byte [0x3f66350d]
outsb dx, byte [esi]
pushfd
sbb eax, 0xeb5d9980
sub ah, byte [esi]
call 0x7f24f195
push edx
test ebx, esp
movsb byte es:[edi], byte [esi]
jb 0x4b365f
cli
sub byte [ecx], ah
lodsb al, byte [esi]
sbb bl, byte [eax + 0x56e0ccf1]
xlatb
mov ds, word [edi + 0x36d71d4f]
sub byte [edi], ch
fnsave dword [esi]
enter 0xffffffffffffbddf, 0xffffffffffffff83
sar byte [edi], 1
cmp dword [edi + 0x55], eax
fcomp dword [0xb4421df0]
xchg edi, eax
cmp dword [eax], ebp
sbb dword [edx + esi - 0x5ed8d63d], edx
lahf
pop ebx
push ebp
sal bl, 1
ret

Function at 0x4bb519
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3338
cmp edx, dword [eax]
je 0x4bb53b
add eax, 8
inc ecx
cmp eax, 0x4c33c8
jl 0x4bb52c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3338]
jne 0x4bb669
mov eax, dword [0x4c7cbc]
cmp eax, 1
je 0x4bb643
test eax, eax
jne 0x4bb56c
cmp dword [0x4c3264], 1
je 0x4bb643
cmp edx, 0xfc
je 0x4bb669
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb5a3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bbf00
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc390
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb5e6
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc390
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c09f4
push edi
call fcn.004be260
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bbf00
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbf10
lea eax, [ebp - 0xa0]
push 0x4c09d4
push eax
call fcn.004bbf10
push dword [esi + 0x4c333c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbf10
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be1d4
add esp, 0x2c
pop edi
jmp 0x4bb669
lea eax, [ebp + 8]
lea esi, [esi + 0x4c333c]
push 0
push eax
push dword [esi]
call fcn.004bc390
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x45701c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x457054]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x457035
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x457044
or bl, 4
test esi, 0x20000000
je 0x45704f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45d810
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45d822
add esp, 0xfffffff0
call fcn.00403858
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004220a0
mov eax, dword [0x48b2e8]
mov dword [eax + 4], ebx
mov dword [eax], 0x45dbb4
mov eax, dword [0x48b2f4]
mov dword [eax + 4], ebx
mov dword [eax], 0x45dbc0
mov eax, ebx
call fcn.0045dbcc
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x417a70]
call fcn.004034c4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x417a70]
call fcn.004034c4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x417a70]
call fcn.004034c4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x417a70]
call fcn.004034c4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x417a70]
call fcn.004034c4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x459fe4
push eax
push 0
push 0
mov eax, dword [0x48b43c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x423aec]
call fcn.00425200
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x423aec]
call fcn.00425200
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x423aec]
call fcn.00425200
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045e034
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45df10
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45df10
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45df10
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45d95f
call fcn.004038b0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x404b0d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x404b1c
pop dword [ebp - 0x28]
mov eax, 0x457eb96c
add eax, 0xbac191b0
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x40fa99b6
add dword [ebp - 0x38], 0xd57ab95
mov dword [ebp - 0x34], 0x264dc117
add dword [ebp - 0x34], 0xbe58b2e
mov dword [ebp - 0x30], 0x81c4298
sub dword [ebp - 0x30], 0xbbcffe6a
mov dword [ebp - 0x2c], 0xcef03c74
add dword [ebp - 0x2c], 0x310fc38c
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xd34b3cd3
add dword [ebp - 0x38], 0xa1272c83
mov dword [ebp - 0x34], 0x5af8ca1
sub dword [ebp - 0x34], 0xc4432b2c
mov dword [ebp - 0x30], 0x9c996a9c
add dword [ebp - 0x30], 0xc6d601d0
mov dword [ebp - 0x2c], 0x30cadda5
add dword [ebp - 0x2c], 0xcf35225b
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x2b53076d
sub eax, 0x2b0d56ed
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x4f5c2
push 0
call eax
mov ecx, 0xbfdb77c5
add ecx, 0x4024d864
xor edi, edi
add edi, eax
mov edx, 0x476000
add edx, dword [ebp - 0x28]
mov esi, 0xa7c18b98
mov dword [ebp - 0xc], 0xb95e1f4f
mov ebx, dword [edx]
sub dword [ebp - 0x20], ecx
xor ebx, esi
mov dword [ebp - 0x14], 0xcb05efd5
mov dword [edi], ebx
add dword [ebp - 0x14], 0xf4e1f824
add edi, 0x414f7b65
add edi, 0xbeb0849f
add edx, 4
loop 0x404c2f
add eax, 0x13377
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x1000df81
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000df90
pop dword [ebp - 0x4c]
mov eax, 0x4bd5c6f3
add eax, 0xc42b189d
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x35f54
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x3baa
mov edi, eax
mov edx, 0xd37adf77
add edx, 0x3c888a89
add edx, dword [ebp - 0x4c]
mov esi, 0xb32f3164
add dword [ebp - 0x2c], ebx
mov ebx, dword [edx]
add dword [ebp - 0x40], 0x1a20cbfa
sub ebx, esi
xor dword [ebp - 0x10], ecx
mov dword [edi], ebx
add dword [ebp - 0x34], eax
add edi, 0xf13dde4a
sub edi, 0xf13dde46
add edx, 4
loop 0x1000dfde
add eax, 0xe17b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x10011126
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x10011130
lea esi, [ecx - 0x78]
jmp 0x10011132
xor esi, esi
lea eax, [esi + 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x50]
test esi, esi
je 0x1001114e
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x10011201
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
test eax, eax
je 0x10011213
add eax, 0xffffff84
jmp 0x10011215
xor eax, eax
and dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
push 7
pop ecx
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0x1002244c
lea ecx, [eax + 4]
call fcn.1000d84d
test eax, eax
js 0x1001127e
cmp dword [ebp + 8], 0
je 0x1001127b
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor edi, edi
call esi
test ax, ax
jns 0x10011253
inc edi
push 0x11
call esi
test ax, ax
jns 0x1001125f
add edi, 2
push 0x12
call esi
test ax, ax
jns 0x1001126b
add edi, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x1c]
jmp 0x1001127e
xor eax, eax
inc eax
xor ecx, ecx
test eax, eax
mov eax, dword [ebp + 8]
setne cl
mov esi, ecx
test eax, eax
je 0x10011294
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x10012b45
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.imp.kernel32.dll_GetTickCount]
push esi
push edi
call ebx
xor ecx, ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x1c], ecx
jg 0x10012b77
jl 0x10012b67
cmp dword [ebp + 0x18], ecx
jae 0x10012b77
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0x14
jmp 0x10012b8f
push 0x14
mov dword [ebp - 8], ecx
pop eax
cmp dword [ebp + 0x1c], ecx
jg 0x10012b8c
jl 0x10012b89
cmp dword [ebp + 0x18], eax
jae 0x10012b8c
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp + 0x10]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10012bf4
xor edi, edi
cmp byte [ebp + 0x20], 0
mov esi, 0xf80001
je 0x10012bb4
mov esi, 0x4ff0001
push esi
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x10012be2
lea eax, [ebp - 0x28]
push eax
inc edi
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp edi, 0x64
jl 0x10012bb4
cmp dword [ebp - 8], 0
jne 0x10012b8f
call ebx
mov ecx, dword [ebp + 0x18]
add ecx, dword [ebp - 0xc]
cmp eax, ecx
jb 0x10012b8f
pop edi
pop esi
pop ebx
leave
ret 0x1c

Function at 0x100138c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
mov ebx, dword [ebp + 0x798]
push esi
mov esi, dword [ebp + 0x79c]
push edi
mov edi, dword [ebp + 0x794]
push 0x3ff
lea eax, [ebp + 0x389]
push 0
push eax
mov byte [ebp + 0x388], 0
call sub.msvcr100.dll_memset
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
mov edi, 0x400
lea eax, [ebp + 0x388]
push edi
push eax
call dword [sym.imp.msvcr100.dll_sprintf_s]
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x388]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001395d
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
jmp 0x100139a0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x10023c4a
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
test eax, eax
je 0x10013987
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100139a0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x78]
push eax
push ebx
call dword [sym.imp.msvcr100.dll__mbscmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ba56
add ebp, 0x78c
leave
ret

Function at 0x10013b9c
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x10013bbd
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10013bbd
inc esi
mov eax, esi
pop esi
ret