joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e43c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x44e455
call fcn.004196a0
mov esi, dword [eax + 0xc]
push 0x6106c8
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x44e4ab
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x44e4aa
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x44e48b
xor esi, esi
jmp 0x44e4a1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.0044e4b3
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4545b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov bh, 0xd0
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x4545c8
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x4545b9
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00454374
mov eax, dword [0x8d4b6622]
inc ebp
test al, 0x50
push eax
call fcn.00454384
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00454339
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x454662
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00454374
mov ch, 0x6a
in eax, 0x83
lea eax, [ebp - 0x40]
push eax
call fcn.00454384
push eax
push esi
push dword [ebp + 8]
invalid
invalid
Function at 0x4547ae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x45480f
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00454384
push eax
push esi
push dword [ebp + 8]
call fcn.00454339
add esp, 0x30
mov dword [ebp - 0xb8], eax
invalid
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00454374
push esi
xor esp, edx
jbe 0x4547ea
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid

Function at 0x454a34
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
inc ebp
or al, 0x66
cmp eax, dword [edi + 6]
inc ebp
or al, 0x66
cmp eax, dword [edi + 6]
jne 0x454a4b
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x454a69
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
invalid
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x454ac7
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x454aae
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x454ab7
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x454ac1
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x454aa3
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x454a2d
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
invalid
je 0x454b14
dec eax
je 0x454b0b
sub eax, 3
je 0x454b02
mov dword [ebp - 4], 0x40
jmp 0x454b31
mov dword [ebp - 4], 4
jmp 0x454b17
mov dword [ebp - 4], 0x20
jmp 0x454b17
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x454b63
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x454ae3
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00454374
invalid
Function at 0x454a5a
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
inc ebp
or al, 0x66
cmp eax, dword [edi + 6]
inc ebp
or al, 0x66
cmp eax, dword [edi + 6]
jne 0x454a4b
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x454a69
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
invalid
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x454ac7
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x454aae
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x454ab7
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x454ac1
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x454aa3
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x454a2d
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
invalid
je 0x454b14
dec eax
je 0x454b0b
sub eax, 3
je 0x454b02
mov dword [ebp - 4], 0x40
jmp 0x454b31
mov dword [ebp - 4], 4
jmp 0x454b17
mov dword [ebp - 4], 0x20
jmp 0x454b17
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x454b63
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x454ae3
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00454374
invalid
Function at 0x45528d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosb byte es:[edi], al
call fcn.00454352
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
jmp dword [edi]
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00454384
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00454339
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00454374
adc eax, 0x68754a36
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.00454374
adc al, 0x90
inc ecx
and byte [ebp - 0x20], 0
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
Function at 0x403640
Capabilities:
Encode data using xor

Disassembly:
imul ecx, ebp
mov edi, ecx
push eax
test esi, 0x26d64f9
mov ecx, 0xafc12fb4
lea esi, [0x613cf7d9]
test edx, 0x49cdf816
mov cl, dl
mov ah, bl
mov ebp, 0x8f45ace9
lea ecx, [0xc158866c]
call 0x403640
or eax, 0xb1cf7f88
lea eax, [0x1c1a77cc]
test ecx, 0x14e8d57d
jmp 0x40362c
add esi, 0xd596
imul eax, esi
imul ebp, esi
xchg bh, al
add esi, 0xf24
adc al, 0xed
cmp al, 0x1e
cmp bh, ch
sbb dh, al
add al, 0x18
test bh, 0x3c
add ebp, 0xedad
dec edx
sbb al, 0x48
imul ebx, ebx
sub ebp, 0x467
pop esi
mov dh, dl
imul eax, edi
add eax, 0x5699889b
movsx edi, ax
sub dh, al
imul edi, ebx
imul ecx, ebp, 0x4414f5d3
mov eax, edx
mov ch, al
xor edi, edi
lea ecx, [0x248fa548]
mov bl, dh
xchg al, bh
mov al, 0xbd
imul ebx, ecx, 0x17d760bc
dec ecx
sub ah, dl
test ch, 0xcf
mov al, ah
test ebx, eax
inc ebx
sub edx, edx
mov ch, dh
sub edx, 0xcf0
inc ebp
xor edx, 0x77c
movzx ebx, al
mov ebx, ebp
add edi, edx
add edi, 0xb95
test al, 0xfd
inc bh
test cl, 0x94
xchg ebp, ebp
cmp edi, 0x30d
jb 0x40367f
add ebp, ebx
test cl, 0x36
mov dl, dl
mov dl, 0x38
mov al, bl
mov ah, dh
mov al, 0xb1
dec ecx
imul ecx, edi
lea eax, [0x64f9b33f]
add esi, 0x1768e1
mov edi, 0xbdccc898
sub esi, 0xae03
lea edx, [0x1d2f2649]
inc ebp
imul edi, ebx, 0x5c0227f1
xchg ebx, eax
dec eax
mov ecx, 0x9a8d3003
movzx ecx, al
imul edi, ecx, 0x150ee4ff
test edx, ebp
je 0x40372b
mov bl, al
sub ebx, ebp
mov cl, 0x19
test bl, bh
push ecx
add eax, esi
pop ebp
jmp 0x40373c
movzx eax, bp
sub edx, ebp
cmp edx, 0xa3a3
jb 0x403751
mov eax, 0x3e3da53b
test ah, cl
mov bh, 0xfa
mov bl, 0x5d
jmp 0x403764
sbb ecx, 0x62ad3e7c
movzx ebp, si
xor al, ah
adc bl, dh
push esi
imul edi, ebx, 0xc16e7e1b
adc bh, ch
xchg eax, edi
test ecx, edi
inc edx
mov ebp, 0
inc dl
inc al
xchg ecx, ebx
mov ebp, 0xaa40
adc eax, 0x5b740d0e
sub ebp, 0x1bb7
xchg bl, bh
movsx ecx, si
ret
Function at 0x405fcc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406032
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404618
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040306c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40601c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406039
lea eax, [ebp - 0x10]
call fcn.004043a8
ret

Function at 0x40afe8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b021
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404498
jmp 0x40b02a
mov eax, ebx
mov edx, esi
call fcn.004043fc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b034
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b055
mov al, byte [esp]
jmp 0x40b057
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c00c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c0e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404440
lea eax, [ebp - 8]
call fcn.004048b8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404868
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c0cc
mov eax, ebx
call fcn.00402a28
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c0c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404868
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c0af
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c0f4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c0af
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c0cc
mov eax, dword [ebp - 0x10]
call fcn.00402a58
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c0e9
lea eax, [ebp - 8]
call fcn.004043a8
ret
Function at 0x40c5bc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c620
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404618
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408354
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c627
lea eax, [ebp - 0xc]
call fcn.004043a8
ret

Function at 0x41a77c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x450884
cmp dword [edi], 0
jne 0x41a7f8
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x450880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x44e3ec
mov ecx, 2
call fcn.00402c48
mov edx, 0x41a754
lea eax, [esi + 5]
call fcn.0041a774
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a774
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a7cd
mov dword [0x450880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41ba0c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41ba12
ret

Function at 0x41de84
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41ded5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41debc
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41deac
jmp 0x41ded5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41debd
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427484
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x4273d0
call sub.user32.dll_EnumWindows
ret

Function at 0x4275a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x427621
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00427004
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x4275c9
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00426c04
cmp dword [ebp - 4], 0
je 0x42760b
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404868
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427628
lea eax, [ebp - 4]
call fcn.004043a8
ret

Function at 0x42a2c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x450b54], 0
je 0x42a413
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x44efdc]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x42a413
mov eax, dword [0x450b58]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x450b54]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x42a3e2
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x450b54]
call fcn.00413d4c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x42a3da
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x42a3da
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x42a3da
mov eax, dword [ebp - 0x14]
call fcn.00432e28
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42a3da
push ebp
call fcn.0042a280
pop ecx
test al, al
jne 0x42a3da
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x42a396
mov eax, dword [ebp - 0x14]
call fcn.00431958
dec eax
jle 0x42a3da
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.0040383c
cmp byte [ebp - 1], 0
je 0x42a3da
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x42a3da
mov edx, dword [ebp - 0x14]
mov eax, dword [0x450b58]
call fcn.00429a4c
inc edi
dec ebx
jne 0x42a329
mov eax, dword [0x450b58]
cmp dword [eax + 8], 0
jle 0x42a3fa
mov eax, dword [0x450b58]
call fcn.00429adc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42a413
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0042a0e8
pop ecx
test al, al
jne 0x42a413
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d9ac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x42d9f8
mov eax, esi
call fcn.00442e5c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42d9f8
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x42d9f8
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x42db37
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x42da38
cmp eax, 0x108
ja 0x42da38
mov eax, esi
call fcn.00442e5c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42db2e
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x42db37
jmp 0x42db2e
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x42db17
cmp eax, 0x20a
ja 0x42db17
test byte [esi + 0x50], 0x80
jne 0x42da6a
sub eax, 0x203
je 0x42da67
sub eax, 3
je 0x42da67
sub eax, 3
jne 0x42da6a
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x42da7e
dec eax
je 0x42da93
dec eax
je 0x42dab0
dec eax
je 0x42da93
jmp 0x42dab7
mov ecx, ebx
mov eax, dword [0x44efdc]
mov eax, dword [eax]
mov edx, esi
call fcn.0044c6b4
jmp 0x42db2e
cmp byte [esi + 0x5d], 1
jne 0x42daa9
mov eax, esi
mov si, 0xffed
call fcn.0040383c
jmp 0x42db37
or word [esi + 0x54], 1
jmp 0x42db2e
and word [esi + 0x54], 0xfffe
jmp 0x42db2e
mov eax, dword [0x450b10]
cmp byte [eax + 0x20], 0
je 0x42db2e
mov eax, dword [0x450b10]
cmp dword [eax + 0x1c], 0
je 0x42db2e
mov eax, dword [ebx]
mov edx, dword [0x450b10]
cmp eax, dword [edx + 0x1c]
jne 0x42db2e
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00442da0
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.0040383c
jmp 0x42db37
cmp eax, 0xb00b
jne 0x42db2e
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0042c314
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430fb8
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x430fd4
cmp dword [esi + 4], 0
je 0x431001
test byte [ebx + 0x55], 1
jne 0x430ff3
mov eax, ebx
call fcn.0042fbc4
test eax, eax
jne 0x430ff3
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x431111
mov edx, esi
mov eax, ebx
call fcn.00430adc
jmp 0x431111
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43110a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00432e28
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0042d8e0
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00430fb8
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00432e28
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431111
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret