joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4151e6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x415283
push ebx
push esi
call fcn.004151af
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00413e34
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x415230
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415282
push edi
push eax
call fcn.00412001
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x415250
call fcn.0040efd8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415281
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00413e34
add esp, 0x20
test eax, eax
jne 0x41526f
push edi
call fcn.0040efd8
jmp 0x415277
push ebx
call fcn.0040efd8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41ae50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41ae7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ae7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x41c20e
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x40
push 0x1000
mov ebx, 0x4ac
xor ebp, ebp
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
mov edi, 0x473040
mov esi, eax
push edi
call fcn.0041c168
push ebx
push edi
push esi
call fcn.00405470
add esp, 0x14
call fcn.0041c14e
push ebp
push ebp
push 0x427040
lea eax, [esi + 0x188]
push eax
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x43fb10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2d000]
push edi
jmp 0x43fb2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43fb31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43fb20
mov eax, 1
add ebx, ebx
jne 0x43fb43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43fb38
jne 0x43fb54
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43fb38
xor ecx, ecx
sub eax, 3
jb 0x43fb68
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43fbda
mov ebp, eax
add ebx, ebx
jne 0x43fb73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43fb80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43fba4
inc ecx
add ebx, ebx
jne 0x43fb90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43fb85
jne 0x43fba1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43fb85
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43fbc4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43fbb5
jmp 0x43fb26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43fbc4
add edi, ecx
jmp 0x43fb26
pop esi
mov edi, esi
mov ecx, 0xa93
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43fbe2
cmp byte [edi], 0x12
jne 0x43fbe2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43fbe7
lea edi, [esi + 0x3c000]
mov eax, dword [edi]
or eax, eax
je 0x43fc5f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x52958]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x52a38]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43fc14
mov ecx, edi
jns 0x43fc43
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x52a40]
or eax, eax
je 0x43fc59
mov dword [ebx], eax
add ebx, 4
jmp 0x43fc31
call dword [esi + 0x52a3c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x43fc90
cmp al, 0xef
ja 0x43fc83
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x43fc65
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x43fc72
mov ebp, dword [esi + 0x52a44]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43fcc4
sub esp, 0xffffff80
jmp 0x41c31f
Function at 0x401000
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
xor ebx, ebx
push ebx
push ebx
push 4
push ebx
push ebx
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x401024
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push esi
push 0x40db3c
push 0x65
push 0x400000
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x401093
push edi
push esi
push 0x400000
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0x400000
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x401092
lea edx, [edi + eax - 0x84b0]
cmp edx, ebx
je 0x40107d
xor ecx, ecx
xor byte [ecx + edx], 0x30
inc ecx
cmp ecx, 0x84b0
jb 0x401070
push ebx
lea ecx, [esp + 0x14]
push ecx
push edi
push eax
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
pop edi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x401430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401447
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401478
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x401474
cmp esi, eax
jae 0x401478
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x401464
cmp esi, eax
jb 0x40147e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x401ced
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410020]
jne 0x401cf7
repz ret
jmp fcn.0040253a

Function at 0x4086eb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004026b2
and dword [ebp - 4], 0
cmp dword [0x411abc], 0
mov ebx, eax
jne 0x40879c
push 0x40d154
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40884d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40d148
push edi
call esi
test eax, eax
je 0x40884d
push eax
call fcn.00402640
mov dword [esp], 0x40d138
push edi
mov dword [0x411abc], eax
call esi
push eax
call fcn.00402640
mov dword [esp], 0x40d124
push edi
mov dword [0x411ac0], eax
call esi
push eax
call fcn.00402640
mov dword [esp], 0x40d108
push edi
mov dword [0x411ac4], eax
call esi
push eax
call fcn.00402640
pop ecx
mov dword [0x411acc], eax
test eax, eax
je 0x40879c
push 0x40d0f0
push edi
call esi
push eax
call fcn.00402640
pop ecx
mov dword [0x411ac8], eax
mov eax, dword [0x411ac8]
cmp eax, ebx
je 0x4087f4
cmp dword [0x411acc], ebx
je 0x4087f4
push eax
call fcn.004026bb
push dword [0x411acc]
mov esi, eax
call fcn.004026bb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4087f4
test edi, edi
je 0x4087f4
call esi
test eax, eax
je 0x4087eb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4087eb
test byte [ebp - 0xc], 1
jne 0x4087f4
or dword [ebp + 0x10], 0x200000
jmp 0x40882d
mov eax, dword [0x411ac0]
cmp eax, ebx
je 0x40882d
push eax
call fcn.004026bb
pop ecx
test eax, eax
je 0x40882d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40882d
mov eax, dword [0x411ac4]
cmp eax, ebx
je 0x40882d
push eax
call fcn.004026bb
pop ecx
test eax, eax
je 0x40882d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x411abc]
call fcn.004026bb
pop ecx
test eax, eax
je 0x40884d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40884f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4050ac
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4052dc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40512f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4052dc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40512f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4052f8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4051b8
xor eax, eax
push ebp
push 0x4051b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404ef4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405196
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405318
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405196
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4051b8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4052d2
cmp byte [ebp - 0xd], 0
jne 0x4051ff
cmp byte [ebp - 0x12], 0
je 0x4052d2
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405218
dec ebx
cmp byte [ebx], 0x2e
je 0x405227
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405217
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4052d2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405264
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4052d2
cmp byte [ebp - 0xd], 0
je 0x4052d2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4052d2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4059a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a0a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004040bc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b50
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4059f4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a11
lea eax, [ebp - 0x10]
call fcn.00403e4c
ret

Function at 0x40a8f8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a931
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f3c
jmp 0x40a93a
mov eax, ebx
mov edx, esi
call fcn.00403ea0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a944
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a965
mov al, byte [esp]
jmp 0x40a967
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40afec
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ae64
mov eax, dword [0x452060]
cmp byte [eax], 0
je 0x40b068
mov eax, dword [0x451e88]
call fcn.00402980
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040816c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b0b0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b09e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x451e38]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x453664]
call fcn.00404eb8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40b904
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b9da
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403ee4
lea eax, [ebp - 8]
call fcn.0040435c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040430c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40b9c4
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40b9bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040430c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40b9a7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40b9ec
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40b9a7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b9c4
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b9e1
lea eax, [ebp - 8]
call fcn.00403e4c
ret

Function at 0x40be58
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40bebc
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004040bc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407cfc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bec3
lea eax, [ebp - 0xc]
call fcn.00403e4c
ret

Function at 0x419fe4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x453884
cmp dword [edi], 0
jne 0x41a060
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x453880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4513ec
mov ecx, 2
call fcn.004028b8
mov edx, 0x419fbc
lea eax, [esi + 5]
call fcn.00419fdc
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00419fdc
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a035
mov dword [0x453880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41b274
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41b27a
ret
Function at 0x429e40
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x429d8c
call sub.user32.dll_EnumWindows
ret

Function at 0x429f60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x429fdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004299c0
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x429f85
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004295c0
cmp dword [ebp - 4], 0
je 0x429fc7
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.0040430c
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429fe4
lea eax, [ebp - 4]
call fcn.00403e4c
ret

Function at 0x42cfa8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x453b54], 0
je 0x42d0f7
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x452004]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x42d0f7
mov eax, dword [0x453b58]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x453b54]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x42d0c6
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x453b54]
call fcn.004135b4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x42d0be
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x42d0be
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x42d0be
mov eax, dword [ebp - 0x14]
call fcn.00435c34
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42d0be
push ebp
call fcn.0042cf64
pop ecx
test al, al
jne 0x42d0be
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x42d07a
mov eax, dword [ebp - 0x14]
call fcn.00434764
dec eax
jle 0x42d0be
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00403310
cmp byte [ebp - 1], 0
je 0x42d0be
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x42d0be
mov edx, dword [ebp - 0x14]
mov eax, dword [0x453b58]
call fcn.0042c730
inc edi
dec ebx
jne 0x42d00d
mov eax, dword [0x453b58]
cmp dword [eax + 8], 0
jle 0x42d0de
mov eax, dword [0x453b58]
call fcn.0042c7c0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42d0f7
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0042cdcc
pop ecx
test al, al
jne 0x42d0f7
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4306cc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x430718
mov eax, esi
call fcn.00445e7c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x430718
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x430718
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x430857
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x430758
cmp eax, 0x108
ja 0x430758
mov eax, esi
call fcn.00445e7c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43084e
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x430857
jmp 0x43084e
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x430837
cmp eax, 0x20a
ja 0x430837
test byte [esi + 0x50], 0x80
jne 0x43078a
sub eax, 0x203
je 0x430787
sub eax, 3
je 0x430787
sub eax, 3
jne 0x43078a
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x43079e
dec eax
je 0x4307b3
dec eax
je 0x4307d0
dec eax
je 0x4307b3
jmp 0x4307d7
mov ecx, ebx
mov eax, dword [0x452004]
mov eax, dword [eax]
mov edx, esi
call fcn.0044f6d0
jmp 0x43084e
cmp byte [esi + 0x5d], 1
jne 0x4307c9
mov eax, esi
mov si, 0xffed
call fcn.00403310
jmp 0x430857
or word [esi + 0x54], 1
jmp 0x43084e
and word [esi + 0x54], 0xfffe
jmp 0x43084e
mov eax, dword [0x453b10]
cmp byte [eax + 0x20], 0
je 0x43084e
mov eax, dword [0x453b10]
cmp dword [eax + 0x1c], 0
je 0x43084e
mov eax, dword [ebx]
mov edx, dword [0x453b10]
cmp eax, dword [edx + 0x1c]
jne 0x43084e
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00445dc0
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403310
jmp 0x430857
cmp eax, 0xb00b
jne 0x43084e
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0042eff8
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret