joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4033b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
xor edi, edi
cmp dword [str.SYSTEMCurrentControlSetServices_amdwddmg], edi
je 0x403429
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x417030
mov edx, dword [eax]
lea ecx, [ebp - 4]
push ecx
push 1
push 0
push edx
push 0x80000002
call ebx
test eax, eax
jne 0x403417
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push 0x4197c0
push 0
push 0
push str.ImagePath
push ecx
mov dword [ebp - 8], 0x104
call esi
test eax, eax
je 0x403432
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
cmp dword [edi*4 + 0x417030], 0
lea eax, [edi*4 + 0x417030]
jne 0x4033d4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push 0x4197c0
push 0
push 0
push str.ImagePath.bak
push ecx
mov dword [ebp - 8], 0x104
call esi
test eax, eax
je 0x403468
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xc
mov esi, 0x4197c0
push str.SystemRoot_
push esi
call fcn.004103ad
add esp, 0xc
test eax, eax
jne 0x403490
mov esi, 0x4197cc
push 9
push str.System32_
push esi
call fcn.004103ad
add esp, 0xc
test eax, eax
jne 0x4034a7
add esi, 9
push 0x413dd0
push esi
call fcn.00404fb9
add esp, 8
test eax, eax
je 0x403429
push eax
call fcn.00405682
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4034d0
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x416174]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
push edi
cmp dword [str.SYSTEMCurrentControlSetServices_amdwddmg], esi
je 0x4035be
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x417030
mov edx, dword [eax]
lea ecx, [ebp - 0x10c]
push ecx
push 3
push 0
push edx
push 0x80000002
call ebx
test eax, eax
jne 0x403559
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0
push str.ImagePath
push edx
mov dword [ebp - 0x110], 0x104
call edi
test eax, eax
je 0x40357e
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp dword [esi*4 + 0x417030], 0
lea eax, [esi*4 + 0x417030]
jne 0x403505
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404c21
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x110]
push ecx
mov ecx, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x114]
push eax
push 0
push str.ImagePath.bak
push ecx
mov dword [ebp - 0x110], 0x104
call edi
test eax, eax
je 0x4035d1
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404c21
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
push eax
mov eax, dword [ebp - 0x10c]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0
push str.ImagePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x403607
mov ecx, dword [ebp - 0x10c]
push ecx
jmp 0x4035b8
mov edx, dword [ebp - 0x10c]
push str.ImagePath.bak
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00404c21
mov esp, ebp
pop ebp
ret
Function at 0x4036b0
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x384
mov eax, dword [0x416174]
xor eax, esp
mov dword [esp + 0x380], eax
cmp dword [str.ati.dll], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], 0
je 0x403804
mov eax, 0x416fe8
mov edx, dword [eax]
lea ecx, [esp + 0x40]
push ecx
push edx
mov eax, str.drivers_atikmdag_patched
call fcn.00403640
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4037e6
xor eax, eax
mov cl, byte [eax + str.drivers_atikmdag_patched]
mov byte [eax + 0x4193b0], cl
inc eax
test cl, cl
jne 0x403710
mov edi, 0x4193b0
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403727
mov ax, word [0x413f88]
mov word [edi], ax
lea eax, [esp + 0x6c]
mov ecx, eax
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403740
mov edi, 0x4193b0
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403751
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x4193b0]
mov byte [esp + eax + 0x180], cl
inc eax
test cl, cl
jne 0x403770
lea ecx, [esp + 0x180]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40379c
test eax, 0x400
jne 0x4037bb
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x184]
push eax
call fcn.004057d0
add esp, 8
test eax, eax
jne 0x4037cb
cmp dword [esp + 0x24], eax
jne 0x4037cb
lea ecx, [esp + 0x180]
push ecx
call fcn.004111a2
add esp, 4
lea edx, [esp + 0x40]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40370e
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0xc]
inc eax
cmp dword [eax*4 + 0x416fe8], 0
mov dword [esp + 0xc], eax
lea eax, [eax*4 + 0x416fe8]
jne 0x4036e7
push str...Sysnative
call fcn.004111df
add esp, 4
test eax, eax
jne 0x403897
push str.drivers_atikmdag_patched
mov eax, str...System32
call fcn.00403640
lea edx, [esp + 0x184]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403834
lea eax, [esp + 0x180]
push eax
call fcn.00410cc8
add esp, 4
lea ecx, [esp + 0x180]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403868
test eax, 0x400
jne 0x403887
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x184]
push eax
call fcn.004057d0
add esp, 8
test eax, eax
jne 0x403897
cmp dword [esp + 0x24], eax
jne 0x403897
lea ecx, [esp + 0x180]
push ecx
call fcn.004111a2
add esp, 4
mov ecx, dword [esp + 0x38c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00404c21
mov esp, ebp
pop ebp
ret
Function at 0x403ff0
Capabilities:
Delete file
Move file

Disassembly:
push esi
call fcn.004036b0
push str.patcher
push 0
call fcn.00410cf8
mov esi, eax
push esi
push str.drivers_atikmdag_patched_atikmdag.sys
call fcn.00404c30
push esi
call fcn.004111a2
add esp, 0x14
test eax, eax
je 0x404027
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push esi
call fcn.00404ce7
push str.drivers_atikmdag_patched
call fcn.00410cc8
add esp, 8
mov eax, 1
pop esi
ret

Function at 0x404050
Capabilities:
Delete file
Move file

Disassembly:
push esi
push str.patcher
push 0
call fcn.00410cf8
mov esi, eax
push esi
push str.drivers_atikmdag.sys.bak
call fcn.00404c30
push esi
call fcn.004111a2
add esp, 0x14
test eax, eax
je 0x404082
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push esi
call fcn.00404ce7
add esp, 4
mov eax, 1
pop esi
ret

Function at 0x4040a0
Capabilities:
Delete file
Move file

Disassembly:
push ebx
xor ebx, ebx
cmp dword [str.drivers_atikmdag.sys.new], ebx
je 0x4040f9
push esi
mov eax, 0x417020
push edi
mov edi, dword [eax]
push str.patcher
push 0
call fcn.00410cf8
mov esi, eax
push esi
push edi
call fcn.00404c30
push esi
call fcn.004111a2
add esp, 0x14
test eax, eax
je 0x4040e1
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push esi
call fcn.00404ce7
inc ebx
lea eax, [ebx*4 + 0x417020]
add esp, 4
cmp dword [eax], 0
jne 0x4040b2
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x404c21
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x416174]
jne 0x404c2b
repz ret
jmp fcn.00405dc7

Function at 0x40ccbc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x416174]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004073f5
and dword [ebp - 0x14], 0
cmp dword [0x4191b4], 0
mov dword [ebp - 0x18], eax
jne 0x40cd6f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40ce17
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40ce17
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4191b4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4191b8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4191bc], eax
call edi
push eax
call esi
mov dword [0x4191c4], eax
test eax, eax
je 0x40cd6f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4191c0], eax
mov eax, dword [0x4191c0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40cdc8
cmp dword [0x4191c4], ecx
je 0x40cdc8
push eax
call esi
push dword [0x4191c4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40cdc8
test ebx, ebx
je 0x40cdc8
call edi
test eax, eax
je 0x40cdbf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40cdbf
test byte [ebp - 8], 1
jne 0x40cdc8
or dword [ebp + 0x10], 0x200000
jmp 0x40cdfb
mov eax, dword [0x4191b8]
cmp eax, dword [ebp - 0x18]
je 0x40cdfb
push eax
call esi
test eax, eax
je 0x40cdfb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40cdfb
mov eax, dword [0x4191bc]
cmp eax, dword [ebp - 0x18]
je 0x40cdfb
push eax
call esi
test eax, eax
je 0x40cdfb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4191b4]
call esi
test eax, eax
je 0x40ce17
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40ce19
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404c21
leave
ret
Function at 0x4113b1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4113d8
call fcn.00404e0a
mov dword [eax], esi
call fcn.00404df7
push 0x16
pop esi
mov dword [eax], esi
call fcn.00406e95
mov eax, esi
jmp 0x41142d
test dword [ebp + 0xc], 0xfffffff9
jne 0x4113be
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x411405
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00404e1d
pop ecx
call fcn.00404df7
mov eax, dword [eax]
jmp 0x41142d
test al, 0x10
jne 0x41142b
test al, 1
je 0x41142b
test byte [ebp + 0xc], 2
je 0x41142b
call fcn.00404e0a
mov dword [eax], 5
call fcn.00404df7
mov dword [eax], 0xd
jmp 0x4113fc
xor eax, eax
pop esi
pop ebp
ret
Function at 0x402994
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4029c3
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403d00
jmp 0x4029e1
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004028bc
mov edi, eax
test ebx, ebx
je 0x4029e1
cmp dword [esi], 0
je 0x4029e1
dec ebx
jmp 0x4029ca
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402db8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402d98
xor eax, eax
push ebp
push 0x402d91
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402dd4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402d98
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x403bcc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402714
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x46e049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403b94
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4051cc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405388
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40522d
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4053a4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40529f
xor eax, eax
push ebp
push 0x405298
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00405024
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405281
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4053c4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40529f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405380
cmp byte [ebp - 0xd], 0
jne 0x4052e1
cmp byte [ebp - 0x12], 0
je 0x405380
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4052fa
dec ebx
cmp byte [ebx], 0x2e
je 0x405309
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4052f9
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405380
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405336
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405380
cmp byte [ebp - 0xd], 0
je 0x405380
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405380
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405934
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x405990
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_ReadFile
dec eax
pop eax
pop ecx
jne 0x405982
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x405977
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x405972
mov eax, 0x64
jmp 0x405987
call sub.kernel32.dll_GetLastError
call fcn.00402804
xor eax, eax
jmp 0x405972
mov eax, 0x67
jmp 0x405987

Function at 0x40aa64
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aa9d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403d00
jmp 0x40aaa6
mov eax, ebx
mov edx, esi
call fcn.00403c6c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40aab0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aad1
mov al, byte [esp]
jmp 0x40aad3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x415810
Capabilities:
Suspend thread

Disassembly:
mov byte [eax + 0xd], 1
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
ret

Function at 0x415820
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x415835
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x4178bc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4178c2
ret

Function at 0x419cb4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x419d05
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x419cec
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x419cdc
jmp 0x419d05
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x419ced
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4255ec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x46e784], 0
sete dl
or al, dl
jne 0x42572c
mov eax, dword [0x46e788]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x46e784]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4256fb
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x46e784]
call fcn.00410180
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4256f3
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x4256f3
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x4256f3
mov eax, dword [ebp - 0x14]
call fcn.0042d8e4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4256f3
push ebp
call fcn.004255a8
pop ecx
test al, al
jne 0x4256f3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x4256af
mov eax, dword [ebp - 0x14]
call fcn.0042c270
dec eax
jle 0x4256f3
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.004030b0
cmp byte [ebp - 1], 0
je 0x4256f3
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4256f3
mov edx, dword [ebp - 0x14]
mov eax, dword [0x46e788]
call fcn.00424df4
inc edi
dec esi
jne 0x425642
mov eax, dword [0x46e788]
cmp dword [eax + 8], 0
jle 0x425713
mov eax, dword [0x46e788]
call fcn.00424e84
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42572c
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00425410
pop ecx
test al, al
jne 0x42572c
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b27c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x42b2ad
je 0x42b307
sub eax, 7
je 0x42b2ce
dec eax
je 0x42b2f8
sub eax, 0x17
je 0x42b3ac
jmp 0x42b3ea
add eax, 0xffffff00
sub eax, 9
jb 0x42b398
add eax, 0xffffff09
sub eax, 0xb
jb 0x42b360
jmp 0x42b3ea
mov eax, ebx
call fcn.0043d038
mov edi, eax
test edi, edi
je 0x42b44a
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x42b453
jmp 0x42b44a
test byte [ebx + 0x44], 0x20
jne 0x42b453
jmp 0x42b44a
mov edx, esi
mov eax, ebx
call fcn.0042887c
cmp dword [esi + 0xc], 0xffffffff
jne 0x42b453
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00406f48
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.004273c8
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.0042b154
test eax, eax
je 0x42b453
mov dword [esi + 0xc], 1
jmp 0x42b453
mov edx, esi
mov eax, ebx
call fcn.0042b1e8
test al, al
je 0x42b44a
cmp dword [esi + 0xc], 0
jne 0x42b453
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.0042d8e4
push eax
call sub.user32.dll_DefWindowProcA
jmp 0x42b453
mov eax, ebx
call fcn.00427f18
test al, al
jne 0x42b453
jmp 0x42b44a
mov eax, ebx
call fcn.0042d8e4
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x42b44a
cmp dword [0x46a72c], 0
je 0x42b44a
mov eax, dword [0x46a72c]
cmp ebx, dword [eax + 0x24]
jne 0x42b44a
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x46a72c]
call fcn.004287b0
jmp 0x42b44a
mov eax, dword [0x46e74c]
cmp byte [eax + 0x20], 0
je 0x42b44a
mov eax, dword [0x46e74c]
cmp dword [eax + 0x1c], 0
je 0x42b44a
mov eax, dword [esi]
mov edx, dword [0x46e74c]
cmp eax, dword [edx + 0x1c]
jne 0x42b44a
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.0043cf7c
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.004030b0
jmp 0x42b453
mov edx, esi
mov eax, ebx
call fcn.0042887c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret