joyce8/EMBER2024-capa huggingface dataset:
Function at 0x510f28
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x680ab0], 0
je 0x511071
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x57b188]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x511071
mov eax, dword [0x680ab4]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x680ab0]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x511040
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x680ab0]
call fcn.0043b61c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x511038
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x511038
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x511038
mov eax, dword [ebp - 0x14]
call fcn.0051b390
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x511038
push ebp
call fcn.00510ee4
pop ecx
test al, al
jne 0x511038
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00404208
test al, al
je 0x511038
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00404208
cmp byte [ebp - 1], 0
je 0x511038
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x511038
mov edx, dword [ebp - 0x14]
mov eax, dword [0x680ab4]
call fcn.00510654
inc edi
dec ebx
jne 0x510f8d
mov eax, dword [0x680ab4]
cmp dword [eax + 8], 0
jle 0x511058
mov eax, dword [0x680ab4]
call fcn.0051070c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x511071
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00510d48
pop ecx
test al, al
jne 0x511071
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51858c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00407848
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.005132b0
test ebx, ebx
jne 0x5185df
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.005184c8
mov ebx, eax
test ebx, ebx
je 0x5186ca
cmp esi, ebx
je 0x518608
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x51861d
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x518655
add eax, 0xffffff5f
sub eax, 2
jb 0x51866d
dec eax
sub eax, 2
jb 0x518681
dec eax
sub eax, 2
jb 0x518677
jmp 0x51868b
add eax, 0xfffffdff
sub eax, 2
jb 0x51866d
dec eax
sub eax, 2
jb 0x518681
dec eax
sub eax, 2
jb 0x518677
jmp 0x51868b
mov byte [esp + 0x120], 0
jmp 0x518693
mov byte [esp + 0x120], 2
jmp 0x518693
mov byte [esp + 0x120], 1
jmp 0x518693
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004fe7f0
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00514a38
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x5186cc
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x519338
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x240], 0
je 0x519354
cmp dword [esi + 4], 0
je 0x519381
test byte [ebx + 0x55], 1
jne 0x519373
mov eax, ebx
call fcn.00517720
test eax, eax
jne 0x519373
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x519491
mov edx, esi
mov eax, ebx
call fcn.00518d40
jmp 0x519491
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x51948a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0051b390
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00514a38
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00519338
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0051b390
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519491
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5207a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x57b49c]
cmp byte [eax + 0xc], 0
je 0x52090d
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x520906
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x680ac0], 0
jne 0x5207f4
push 0x520914
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x52091c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x680ac0], eax
cmp dword [0x579b98], 0
jne 0x5208ef
push 0x52092c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x579b98], eax
cmp dword [0x579b98], 0
je 0x5208ef
push 0x520938
mov eax, dword [0x579b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x680ac4], eax
push 0x520948
mov eax, dword [0x579b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x680ac8], eax
push 0x52095c
mov eax, dword [0x579b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x680acc], eax
push 0x520974
mov eax, dword [0x579b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x680ad0], eax
push 0x52098c
mov eax, dword [0x579b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x680ad4], eax
push 0x5209a0
mov eax, dword [0x579b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x680ad8], eax
push 0x5209b8
mov eax, dword [0x579b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x680adc], eax
push 0x5209d0
mov eax, dword [0x579b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x680ae0], eax
push 0x5209ec
mov eax, dword [0x579b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x680ae4], eax
push 0x5209f8
mov eax, dword [0x579b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x680ae8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52090d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x527080
Capabilities:
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call sub.kernel32.dll_GetCurrentThreadId_1
mov edx, dword [0x57b4a0]
cmp eax, dword [edx]
jne 0x52709f
mov ebx, dword [0x57ac0c]
mov ebx, dword [ebx]
jmp 0x5270a1
xor ebx, ebx
test ebx, ebx
je 0x5270ad
cmp ebx, 0x103
jne 0x5270cf
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
test eax, eax
je 0x5270c3
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
mov ebx, dword [eax]
jmp 0x5270cf
mov eax, 0x1f
call fcn.00408810
mov ebx, eax
test ebx, ebx
je 0x5270db
cmp ebx, 0x103
jne 0x5270e7
mov eax, 0x1f
call fcn.00408810
mov ebx, eax
xor eax, eax
push ebp
push 0x527142
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCurrentThreadId_1
mov edx, dword [0x57b4a0]
cmp eax, dword [edx]
jne 0x527119
xor eax, eax
call fcn.00447148
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x527138
xor eax, eax
call fcn.004a7de4
call sub.kernel32.dll_GetCurrentThreadId_1
xor edx, edx
call fcn.004a8490
push ebx
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x527154
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x528fb4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x529142
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00403148
mov ebx, eax
call fcn.00403168
mov esi, eax
mov eax, dword [0x57b2cc]
xor edx, edx
mov dword [eax], edx
mov eax, esi
call fcn.0040e524
test al, al
je 0x52900a
mov eax, ebx
call fcn.0040e524
test al, al
je 0x52900a
mov eax, ebx
call fcn.0040ec24
test al, al
jne 0x529021
call fcn.00403188
test eax, eax
je 0x52912c
call fcn.004031bc
jmp 0x52912c
mov eax, dword [0x57ac0c]
xor edx, edx
mov dword [eax], edx
push 2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0052c2bc
test al, al
jne 0x529083
mov eax, ebx
mov edx, dword [0x426ea4]
call fcn.00404198
test al, al
je 0x529083
cmp dword [ebx + 4], 0
je 0x529083
push 0
lea edx, [ebp - 0x104]
mov eax, dword [ebx]
call fcn.00403eec
lea edx, [ebp - 0x104]
lea eax, [ebp - 4]
call fcn.00405290
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 4]
mov ecx, 0x2010
call fcn.0041bbf4
mov eax, dword [0x57ac0c]
cmp dword [eax], 0
je 0x52909a
mov eax, dword [0x57ac0c]
cmp dword [eax], 0x103
jne 0x529119
mov eax, ebx
mov edx, dword [0x427070]
call fcn.00404198
test al, al
je 0x5290c0
cmp dword [ebx + 0xc], 0
je 0x5290c0
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov edx, dword [0x57ac0c]
mov dword [edx], eax
jmp 0x5290f7
mov eax, ebx
mov edx, dword [0x427838]
call fcn.00404198
test al, al
je 0x5290ec
mov eax, dword [ebx + 0xc]
test eax, eax
jns 0x5290dd
call fcn.00403edc
call fcn.00408810
mov edx, dword [0x57ac0c]
mov dword [edx], eax
jmp 0x5290f7
mov eax, dword [0x57ac0c]
mov dword [eax], 0xeedfade
mov eax, dword [0x57ac0c]
cmp dword [eax], 0
je 0x52910e
mov eax, dword [0x57ac0c]
cmp dword [eax], 0x103
jne 0x529119
mov eax, dword [0x57ac0c]
mov dword [eax], 0x1f
mov eax, dword [0x57ac0c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529149
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x529a24
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x529b01
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00415e04
call fcn.00424c88
mov eax, 0x529b10
call fcn.0041a884
mov eax, 0x529b10
call fcn.004252c8
test bl, bl
je 0x529ad0
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405224
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.004038b8
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, edi
call fcn.0040550c
push eax
push 0
push 0x200
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
lea edx, [ebp - 0x5c]
xor eax, eax
call fcn.0040f2e8
mov eax, dword [ebp - 0x5c]
call fcn.0040550c
push eax
call sub.kernel32.dll_CreateProcessA
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529b08
lea eax, [ebp - 0x5c]
call fcn.0040502c
lea eax, [ebp - 4]
call fcn.0040502c
ret

Function at 0x52cf88
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.004aabd8
mov edi, eax
dec edi
test edi, edi
jl 0x52cffe
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, esi
call fcn.004aabe0
mov byte [eax + 0x58], 0
mov edx, ebx
mov eax, esi
call fcn.004aabe0
mov eax, dword [eax + 4]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 4]
je 0x52cffa
push ebp
mov edx, ebx
mov eax, esi
call fcn.004aabe0
call fcn.0052cf04
pop ecx
test al, al
je 0x52cffa
mov edx, ebx
mov eax, esi
call fcn.004aabe0
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x52cffa
mov edx, ebx
mov eax, esi
call fcn.004aabe0
mov byte [eax + 0x58], 1
inc ebx
dec edi
jne 0x52cfa1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x52d00c
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
mov eax, edi
call fcn.004aabd8
mov esi, eax
dec esi
test esi, esi
jl 0x52d05a
inc esi
xor ebx, ebx
mov edx, ebx
mov eax, edi
call fcn.004aabe0
call fcn.0052d004
test al, al
je 0x52d056
mov edx, ebx
mov eax, edi
call fcn.004aabe0
mov byte [eax + 0x58], 0
mov edx, ebx
mov eax, edi
call fcn.004aabe0
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_ResumeThread
inc ebx
dec esi
jne 0x52d025
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x52f704
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x52f7ac
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040ede8
mov ebx, eax
test bl, bl
jne 0x52f791
mov bl, 1
push 4
lea eax, [ebp - 4]
push eax
push 0x52f7bc
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x52f791
push 4
lea eax, [ebp - 4]
push eax
push 0x52f7d4
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x52f791
call fcn.00403544
mov esi, eax
test esi, esi
jle 0x52f78f
mov dword [ebp - 4], 1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004035a4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00427d08
mov eax, dword [ebp - 8]
mov edx, 0x52f7f0
call fcn.00405458
je 0x52f791
inc dword [ebp - 4]
dec esi
jne 0x52f764
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52f7b3
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405050
ret

Function at 0x52f8d8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
call fcn.0040f860
test al, al
jne 0x52f950
cmp dword [0x680bc4], 0
je 0x52f950
mov eax, dword [0x680bc4]
call fcn.00444dd8
mov eax, dword [0x57e7f8]
call fcn.0041be74
test al, al
jne 0x52f92f
call sub.kernel32.dll_GetCurrentThreadId_1
mov edx, dword [0x57b4a0]
cmp eax, dword [edx]
jne 0x52f923
mov eax, dword [0x680bc4]
mov eax, dword [eax + 4]
call fcn.0052f87c
jmp 0x52f946
mov eax, dword [0x680bc4]
call fcn.00444de0
jmp 0x52f946
push 0x64
call sub.kernel32.dll_Sleep_2
push 1
mov eax, dword [0x680bc4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, 0x680bc4
call fcn.0040f894
pop ebp
ret

Function at 0x5333f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x5334ae
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0052fa7c
call fcn.00488f84
test al, al
je 0x533493
call fcn.0040f584
lea edx, [ebp - 4]
call fcn.0040f2e8
mov eax, dword [ebp - 4]
call fcn.00457ecc
test al, al
je 0x533454
call fcn.0040f584
cmp eax, dword [0x57e7f8]
je 0x533493
lea edx, [ebp - 8]
mov eax, dword [0x57e7f8]
call fcn.0040f2e8
mov eax, dword [ebp - 8]
call fcn.00457ecc
test al, al
jne 0x533493
push 0
call fcn.0052fa7c
lea ecx, [ebp - 0xc]
mov dl, 2
call fcn.004899d8
mov eax, dword [ebp - 0xc]
push eax
call fcn.0052fa7c
lea ecx, [ebp - 0x10]
mov dl, 0x99
call fcn.004899d8
mov eax, dword [ebp - 0x10]
mov ecx, 0x10
pop edx
call fcn.0041bbf4
push 0xb
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5334b5
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405050
ret
Function at 0x56771c
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5677f8
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, 0x56780c
mov eax, ebx
call fcn.00428ee0
mov eax, dword [ebp - 4]
call fcn.00428bec
test al, al
je 0x567791
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x56781c
call fcn.00429a7c
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x263064]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x567844
call fcn.00429a7c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x263064]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.kernel32.dll_MoveFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5677ff
lea eax, [ebp - 0x14]
call fcn.0040502c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405050
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x793058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007931a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x79307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x79306a
add dl, dl
jne 0x793089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7930dc
xor eax, eax
add dl, dl
jne 0x793096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x79317d
add dl, dl
jne 0x7930a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7930b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7930bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7930c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7930d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x793075
mov eax, 1
add dl, dl
jne 0x7930ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7930f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7930e1
sub eax, ebx
mov ebx, 1
jne 0x793128
mov ecx, 1
add dl, dl
jne 0x79310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x793119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x793105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x793075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x79313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x79314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x793136
cmp eax, 0x7d00
jae 0x79316d
cmp eax, 0x500
jb 0x793168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x793075
cmp eax, 0x7f
ja 0x793170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x793075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x79319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x793075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x537028
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x53703a
add esp, 0xfffffff0
call fcn.00406018
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004534f4
mov eax, dword [0x5682d4]
mov dword [eax + 4], ebx
mov dword [eax], 0x53746c
mov eax, dword [0x5682e4]
mov dword [eax + 4], ebx
mov dword [eax], 0x537478
mov eax, ebx
call fcn.00537484
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x438e44]
call fcn.004059dc
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x438e44]
call fcn.004059dc
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x438e44]
call fcn.004059dc
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x438e44]
call fcn.004059dc
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x438e44]
call fcn.004059dc
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x48], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x60]
push eax
mov eax, 0x531e5c
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x4646d8]
call fcn.0046a6d8
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4646d8]
call fcn.0046a6d8
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4646d8]
call fcn.0046a6d8
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x4646d8]
call fcn.0046a6d8
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x4646d8]
call fcn.0046a6d8
mov dword [ebx + 0x90], eax
mov eax, ebx
call fcn.00537a7c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x537898
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x537898
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x537898
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x537898
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x537898
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5371b7
call fcn.00406070
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret