joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14853b4
Capabilities:
Terminate process

Disassembly:
cmp ecx, 0
je 0x148549a
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x1485404
cmp al, 0xb
je 0x148541e
cmp al, 0xc
je 0x1485435
cmp al, 0xd
je 0x1485444
cmp al, 0xe
je 0x1485462
cmp al, 0xf
je 0x1485478
cmp al, 0x11
je 0x1485487
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.01483028
cmp ecx, 1
mov eax, ebx
jg 0x1485415
call fcn.014847f4
jmp 0x1485496
mov edx, ecx
call fcn.01484818
jmp 0x1485496
cmp ecx, 1
mov eax, ebx
jg 0x148542c
call fcn.01484e4c
jmp 0x1485496
mov edx, ecx
call fcn.01484e64
jmp 0x1485496
mov eax, ebx
add ebx, 0x10
call fcn.01486784
dec edi
jg 0x1485435
jmp 0x1485496
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.014853b4
dec edi
jg 0x1485447
pop ebp
jmp 0x1485496
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.01485388
dec edi
jg 0x1485465
pop ebp
jmp 0x1485496
mov eax, ebx
add ebx, 4
call fcn.01487a68
dec edi
jg 0x1485478
jmp 0x1485496
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.014872c0
dec edi
jg 0x1485487
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x148549c
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.014853b4

Function at 0x14854a8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x14854d4
mov edx, eax
add eax, esi
add edx, ebx
call fcn.014830f8
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x1485513
cmp cl, 0xb
je 0x1485524
cmp cl, 0xc
je 0x1485535
cmp cl, 0xd
je 0x1485546
cmp cl, 0xe
je 0x1485566
cmp cl, 0xf
je 0x148557f
cmp cl, 0x11
je 0x1485590
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.01483028
mov edx, dword [esi + eax]
add eax, ebx
call fcn.01484848
mov eax, 4
jmp 0x14855a1
mov edx, dword [esi + eax]
add eax, ebx
call fcn.01484e88
mov eax, 4
jmp 0x14855a1
lea edx, [esi + eax]
add eax, ebx
call fcn.014858b8
mov eax, 0x10
jmp 0x14855a1
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.014855c4
pop eax
jmp 0x14855a1
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.014854a8
pop eax
jmp 0x14855a1
mov edx, dword [esi + eax]
add eax, ebx
call fcn.01487a80
mov eax, 4
jmp 0x14855a1
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.014872fc
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x14854c2
pop ecx
sub ecx, eax
jle 0x14855bd
lea edx, [ebx + eax]
add eax, esi
call fcn.014830f8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x14855c4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x148560a
cmp cl, 0xb
je 0x1485621
cmp cl, 0xc
je 0x1485635
cmp cl, 0xd
je 0x1485649
cmp cl, 0xe
je 0x148566a
cmp cl, 0xf
je 0x1485687
cmp cl, 0x11
je 0x148569b
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.01483028
mov eax, ebx
mov edx, dword [esi]
call fcn.01484848
add ebx, 4
add esi, 4
dec ebp
jne 0x148560a
jmp 0x14856af
mov eax, ebx
mov edx, dword [esi]
call fcn.01484e88
add ebx, 4
add esi, 4
dec ebp
jne 0x1485621
jmp 0x14856af
mov eax, ebx
mov edx, esi
call fcn.014858b8
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x1485635
jmp 0x14856af
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.014855c4
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x1485652
jmp 0x14856af
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.014854a8
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x148566a
jmp 0x14856af
mov eax, ebx
mov edx, dword [esi]
call fcn.01487a80
add ebx, 4
add esi, 4
dec ebp
jne 0x1485687
jmp 0x14856af
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.014872fc
add ebx, 4
add esi, 4
dec ebp
jne 0x148569b
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x14858b8
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.01483028
cmp eax, edx
je 0x1485950
cmp word [eax], 8
jb 0x14858f0
push eax
push edx
cmp word [eax], 0x100
je 0x14858e6
cmp word [eax], 0x101
je 0x14858de
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x14858ee
call dword [0x15253e8]
jmp 0x14858ee
add eax, 8
call fcn.014847f4
pop edx
pop eax
cmp word [edx], 8
jae 0x1485907
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x1485922
cmp word [edx], 0x101
jne 0x148593c
push eax
call 0x14858f6
pop eax
jmp dword [0x15253f0]
mov edx, dword [edx + 8]
or edx, edx
je 0x1485933
mov ecx, dword [edx - 8]
inc ecx
jle 0x1485933
lock inc dword [edx - 8]
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x148586c
ret

Function at 0x1485e00
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 8
jne 0x1485e0e
mov edx, dword [edx + 8]
jmp fcn.01484e88
push ebx
mov ebx, eax
sub esp, 0x10
mov word [esp], 0
mov eax, esp
mov ecx, 8
call fcn.01485b44
mov eax, ebx
mov edx, dword [esp + 8]
call fcn.01484e3c
add esp, 0x10
pop ebx
ret

Function at 0x1485ea8
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 0
je fcn.01487a68
cmp word [edx], 0xd
je 0x1485ef3
cmp word [edx], 9
je 0x1485ef3
cmp word [edx], 0x400d
je 0x1485ee9
cmp word [edx], 0x4009
je 0x1485ee9
cmp word [edx], 0x101
jne fcn.01485864
jmp fcn.01485e38
mov edx, dword [edx + 8]
mov edx, dword [edx]
jmp fcn.01487a80
mov edx, dword [edx + 8]
jmp fcn.01487a80
Function at 0x1485efc
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 0
je fcn.01487a68
cmp word [edx], 9
je 0x1485f21
cmp word [edx], 0x4009
jne fcn.01485864
mov edx, dword [edx + 8]
mov edx, dword [edx]
jmp fcn.01487a80
mov edx, dword [edx + 8]
jmp fcn.01487a80

Function at 0x1486044
Capabilities:
Terminate process

Disassembly:
push eax
cmp word [eax], 8
jb 0x1486052
push edx
call fcn.01485874
pop edx
xor eax, eax
test edx, edx
je 0x148606e
mov eax, dword [edx - 4]
shr eax, 1
je 0x148606e
push eax
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x1484e34
pop edx
mov word [edx], 8
mov dword [edx + 8], eax
ret

Function at 0x1486148
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
call fcn.0148678c
xor eax, eax
push ebp
push 0x148613b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
call dword [0x15253ec]
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x18]
call fcn.01486148
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1486142
lea eax, [ebp - 0x18]
call fcn.01486784
ret
cmp word [edx], 0x101
je 0x14860e4
cmp word [edx], 0x100
jne fcn.014858b8
cmp word [eax], 8
jb 0x148616d
push eax
push edx
call fcn.01485874
pop edx
pop eax
mov word [eax], 8
add eax, 8
add edx, 8
xor ecx, ecx
mov edx, dword [edx]
mov dword [eax], ecx
jmp fcn.01484fe8

Function at 0x14862c8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov ebx, ecx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x14862f1
cmp eax, 0x100
jne 0x1486324
mov eax, 8
cmp edx, 0x11
jbe 0x1486303
cmp edx, 0x100
jne 0x1486322
mov edx, 8
mov al, byte [eax + 0x1522068]
mov dl, byte [edx + 0x1522068]
movzx ecx, byte [edx + eax*8 + 0x152207c]
call dword [ecx*4 + 0x1486333]
pop edi
pop esi
pop ebx
ret
mov eax, edx
cmp eax, 0x101
jne 0x1486354
pop edi
pop esi
pop ebx
jmp fcn.01486240
pop edi
pop esi
pop ebx
jmp 0x148586c

Function at 0x1486528
Capabilities:
Terminate process

Disassembly:
mov ecx, 0
jmp fcn.014862c8
Function at 0x1486674
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov esi, edx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x148669a
cmp eax, 0x100
jne 0x14866c9
mov eax, 8
cmp edx, 0x11
jbe 0x14866ac
cmp edx, 0x100
jne case.default.0x14866c0
mov edx, 8
mov al, byte [eax + 0x1522068]
mov dl, byte [edx + 0x1522068]
movzx ecx, byte [edx + eax*8 + 0x152207c]
jmp dword [ecx*4 + 0x14866db]
mov eax, edx
cmp eax, 0x101
jne case.0x14866c0.0
pop edi
pop esi
call fcn.014865d8
push eax
popf
ret
pop edi
pop esi
jmp 0x148586c
cmp al, dl
pop edi
pop esi
ret
mov eax, esi
call fcn.01485c6c
xchg edi, eax
call fcn.01485c6c
cmp eax, edi
pop edi
pop esi
ret
mov eax, edi
call fcn.01485d0c
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.01485d0c
fld xword [esp]
add esp, 0xc
fcompp
fnstsw ax
mov al, ah
and ax, 0x4001
ror al, 1
or ah, al
sahf
pop edi
pop esi
ret
mov eax, edi
call fcn.01485d68
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.01485d68
fld xword [esp]
add esp, 0xc
jmp 0x1486733
mov eax, edi
mov edx, esi
call fcn.01486564
cmp eax, 0
pop edi
pop esi
ret
mov eax, esi
call fcn.01485cd8
xchg edi, eax
call fcn.01485cd8
mov edx, edi
cmp al, dl
pop edi
pop esi
ret
Function at 0x14875f4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x125]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x14877cc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x1487653
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x14877e8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x14876c7
xor eax, eax
push ebp
push 0x14876c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x1c], 5
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x16]
push eax
push 0
push 0
push ebp
lea eax, [ebp - 0x125]
call fcn.0148740c
pop ecx
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x14876a9
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x16]
push eax
push 0
push 0
push 0x1487808
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14876c7
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x125]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0x11]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor eax, eax
mov dword [ebp - 8], eax
cmp byte [ebp - 0x125], 0
je 0x14877c5
cmp byte [ebp - 0x11], 0
jne 0x148770c
cmp byte [ebp - 0x16], 0
je 0x14877c5
lea eax, [ebp - 0x125]
push eax
call sub.kernel32.dll_lstrlenA
lea edx, [ebp - 0x125]
add eax, edx
mov dword [ebp - 0x20], eax
jmp 0x1487728
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp byte [eax], 0x2e
je 0x148773b
lea eax, [ebp - 0x125]
cmp eax, dword [ebp - 0x20]
jne 0x1487725
lea eax, [ebp - 0x125]
cmp eax, dword [ebp - 0x20]
je 0x14877c5
inc dword [ebp - 0x20]
cmp byte [ebp - 0x16], 0
je 0x148776f
lea eax, [ebp - 0x16]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x125]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x14877c5
cmp byte [ebp - 0x11], 0
je 0x14877c5
lea eax, [ebp - 0x11]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x125]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x14877c5
mov byte [ebp - 0xf], 0
lea eax, [ebp - 0x11]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x125]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1487a9c
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.01487a68
push eax
push ecx
push edx
mov ecx, dword [eax]
test ecx, ecx
je 0x1487ab6
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [esp]
mov eax, dword [edx]
call dword [eax]
test eax, eax
je 0x1487ac5
mov al, 0x17
jmp fcn.01483028
ret
Function at 0x1487bb4
Capabilities:
Terminate process

Disassembly:
test eax, eax
jns 0x1487bce
mov ecx, dword [0x1525014]
test ecx, ecx
je 0x1487bc7
mov edx, dword [esp]
call ecx
mov al, 0x18
jmp fcn.01483028
ret

Function at 0x148ab40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x148ab71
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x148ab78
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x148aba9
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x148ac80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.01484c60
push eax
call sub.kernel32.dll_DeleteFileA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x148d790
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x148d7d8
mov ecx, dword [ebp - 0x10]
dec ecx
lea edx, [ebp - 0x110]
mov eax, dword [ebp + 8]
call fcn.014848dc
jmp 0x148d7e3
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.01484848
mov esp, ebp
pop ebp
ret 4

Function at 0x148d7ec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x148d81a
mov al, byte [ebp - 0xc]
mov byte [ebp - 0xa], al
jmp 0x148d820
mov al, byte [ebp - 9]
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xa]
mov esp, ebp
pop ebp
ret
Function at 0x148f890
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov eax, dword [0x1523ce4]
cmp dword [eax], 0
je 0x148f8c7
push 0xa
push 0x148f92c
mov eax, dword [0x1523ce4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [0x1523ce4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 4], eax
jmp 0x148f919
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [0x1523f7c]
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x148f919
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0xa
push 0x148f92c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x148f919
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x148f8dc
cmp dword [ebp - 4], 0
jne 0x148f924
call fcn.0148f83c
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1497eac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindResourceA
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x1497ee2
push ebp
call fcn.01497e3c
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0
jne 0x1497f08
push ebp
call fcn.01497e3c
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SizeofResource
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
push eax
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp - 8]
pop ecx
call fcn.01497850
mov esp, ebp
pop ebp
ret 4

Function at 0x149dc04
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0xd], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
pop ecx
pop ebp
ret

Function at 0x149dc24
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x149dc43
mov eax, dword [ebp - 4]
mov byte [eax + 0xd], 0
pop ecx
pop ebp
ret

Function at 0x14a03cc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x14a03d2
ret
Function at 0x14a2f5c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x14a2fad
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x14a2f94
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x14a2f84
jmp 0x14a2fad
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x14a2f95
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x14b131c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
cmp dword [0x152576c], 0
jne 0x14b13c9
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
mov eax, dword [0x1525768]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, 0x1522744
mov ecx, 2
call fcn.014830f8
mov edx, 0x14b12d8
mov eax, dword [ebp - 8]
add eax, 5
call fcn.014b12f8
mov edx, dword [ebp - 8]
mov dword [edx + 6], eax
mov eax, dword [ebp - 8]
add eax, 0xa
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe8
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, dword [ebp - 0xc]
call fcn.014b12f8
mov edx, dword [ebp - 0xc]
mov dword [edx + 1], eax
mov eax, dword [0x152576c]
mov edx, dword [ebp - 0xc]
mov dword [edx + 5], eax
mov eax, dword [ebp - 0xc]
mov dword [0x152576c], eax
add dword [ebp - 0xc], 0xd
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cmp eax, 0xffc
jl 0x14b1383
mov eax, dword [ebp - 8]
mov dword [0x1525768], eax
mov eax, dword [0x152576c]
mov dword [ebp - 4], eax
mov eax, dword [0x152576c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 5]
mov dword [0x152576c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 9], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x14b1524
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov word [ebp - 2], ax
mov al, byte [0x14b157c]
mov byte [ebp - 3], al
test byte [ebp - 2], 4
je 0x14b153e
or byte [ebp - 3], 1
test byte [ebp - 2], 8
je 0x14b1548
or byte [ebp - 3], 4
test byte [ebp - 2], 1
je 0x14b1552
or byte [ebp - 3], 8
test byte [ebp - 2], 2
je 0x14b155c
or byte [ebp - 3], 0x10
test byte [ebp - 2], 0x10
je 0x14b1566
or byte [ebp - 3], 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x14b1576
or byte [ebp - 3], 2
mov al, byte [ebp - 3]
pop ecx
pop ebp
ret

Function at 0x14b1580
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov al, byte [0x14b15c4]
mov byte [ebp - 5], al
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x14b15a1
or byte [ebp - 5], 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x14b15b1
or byte [ebp - 5], 4
test byte [ebp - 1], 0x20
je 0x14b15bb
or byte [ebp - 5], 2
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x14b8fc0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
test dl, dl
je 0x14b8fd2
add esp, 0xfffffff0
call fcn.01483bb4
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0149dcc8
mov eax, dword [ebp - 4]
call fcn.014b94d4
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov dl, 1
mov eax, dword [0x1491fe4]
call fcn.014837bc
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov dl, 1
mov eax, dword [0x1491fe4]
call fcn.014837bc
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov dl, 1
mov eax, dword [0x1491fe4]
call fcn.014837bc
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], eax
mov dl, 1
mov eax, dword [0x1491fe4]
call fcn.014837bc
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], eax
mov dl, 1
mov eax, dword [0x1491fe4]
call fcn.014837bc
mov edx, dword [ebp - 4]
mov dword [edx + 0x70], eax
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0x10], eax
push 0x5a
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_GetDeviceCaps
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, 0x14b4dec
push eax
push 0
push 0
mov eax, dword [0x1523e00]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x149f8e4]
call fcn.014a0fd0
mov edx, dword [ebp - 4]
mov dword [edx + 0x78], eax
mov dl, 1
mov eax, dword [0x149f8e4]
call fcn.014a0fd0
mov edx, dword [ebp - 4]
mov dword [edx + 0x7c], eax
mov dl, 1
mov eax, dword [0x149f8e4]
call fcn.014a0fd0
mov edx, dword [ebp - 4]
mov dword [edx + 0x74], eax
mov eax, dword [ebp - 4]
call fcn.014b99e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x14b986c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7c]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x14b986c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x14b986c
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x14b9126
call fcn.01483c0c
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret