joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401468
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push eax
push 0x80
push 3
push eax
inc ebx
mov dword [ebp - 4], eax
push ebx
push 0x80000000
mov edi, edx
push ecx
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, 0xffffffff
je 0x4015c4
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, 0xffffffff
jne 0x40150a
mov edi, dword [ebp - 0x10]
push edi
push str._s.new
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov byte [eax], bl
cmp ecx, 0xffffffff
jne 0x40150a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4015c4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x4015b3
push esi
call fcn.00401be9
mov edi, eax
pop ecx
test edi, edi
je 0x4015b3
push esi
push 0
push edi
call fcn.00401bff
mov esi, dword [ebp - 8]
lea eax, [ebp - 4]
add esp, 0xc
push 0
push eax
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
shl eax, 2
push eax
mov dword [ebp - 0x10], eax
call fcn.00401be9
mov dword [ebp - 8], eax
pop ecx
test eax, eax
je 0x4015aa
push dword [ebp - 0x10]
push 0
push eax
call fcn.00401bff
mov edx, dword [ebp - 8]
add esp, 0xc
mov ecx, edi
call fcn.00401057
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4015a1
push 0
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor ecx, ecx
test eax, eax
cmovne ebx, ecx
push dword [ebp - 8]
call fcn.00401bd3
pop ecx
push edi
call fcn.00401bd3
pop ecx
jmp 0x4015b6
mov esi, dword [ebp - 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4015cd
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 0x10], edx
mov edi, ecx
xor ebx, ebx
push eax
push edi
mov dword [ebp - 8], ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x40168a
cmp esi, 0x800
ja 0x40168a
push 0x7ff
lea eax, [ebp - 0x80f]
mov byte [ebp - 0x810], bl
push ebx
push eax
call fcn.00401bff
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40168a
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0x40221c
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40168a
cmp dword [ebp - 0xc], ebx
je 0x40168a
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
push edx
push 0x402220
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
mov bl, 1
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401693
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40181d
xor eax, eax
xor esi, esi
push 0x3e
mov word [ebp - 0x58], ax
lea eax, [ebp - 0x56]
push esi
push eax
call fcn.00401bff
push 0x40
lea eax, [ebp - 0x9c]
mov dword [ebp - 0xa0], 0x44
push esi
push eax
call fcn.00401bff
xor eax, eax
mov dword [ebp - 0x14], esi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
push 0x7fe
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0xb08], ax
lea eax, [ebp - 0xb06]
push eax
call fcn.00401bff
xor eax, eax
push 0x206
mov word [ebp - 0x308], ax
lea eax, [ebp - 0x306]
push esi
push eax
call fcn.00401bff
add esp, 0x30
lea eax, [ebp - 0x308]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrW]
lea eax, [ebp - 0x308]
push 0x402238
push eax
call edi
mov esi, eax
test esi, esi
je 0x401779
push 0x402240
add esi, 6
push esi
call edi
test eax, eax
je 0x401779
cmp eax, esi
jbe 0x401779
sub eax, esi
sar eax, 1
cmp eax, 0x20
jg 0x401779
push esi
lea edx, [eax + 1]
lea ecx, [ebp - 0x58]
call fcn.004011c9
mov esi, dword [ebp - 4]
xor edi, edi
test esi, esi
jne 0x40179f
push edi
lea eax, [ebp - 0x58]
push eax
push ebx
lea eax, [ebp - 0xb08]
push str.__s_____install_pid_s____install_error_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
jmp 0x4017ea
xor eax, eax
push 0x5e
mov word [ebp - 0x100], ax
lea eax, [ebp - 0xfe]
push edi
push eax
call fcn.00401bff
lea edx, [ebp - 0x100]
lea ecx, [ebp - 0x308]
call fcn.004015cd
lea eax, [ebp - 0x100]
push eax
push esi
lea eax, [ebp - 0x58]
push eax
push ebx
lea eax, [ebp - 0xb08]
push str.__s_____install_pid_s____install_error_d____install_ver_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xa0]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xb08]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40181d
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401824
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
xor eax, eax
xor esi, esi
push 0x5e
mov word [ebp - 0x68], ax
mov ebx, ecx
lea eax, [ebp - 0x66]
push esi
push eax
call fcn.00401bff
xor eax, eax
push 0x3e
mov word [ebp - 0xa8], ax
lea eax, [ebp - 0xa6]
push esi
push eax
call fcn.00401bff
add esp, 0x18
mov dword [ebp - 4], 0x30
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 8]
push eax
push str.lbmini_version
push str.SoftwareKingsoftLBMINI
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
je 0x4018d0
lea edx, [ebp - 0x68]
mov ecx, ebx
call fcn.004015cd
lea ecx, [ebp - 0x68]
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4018a4
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x68]
push eax
push 1
push str.lbmini_version
push str.SoftwareKingsoftLBMINI
push 0x80000001
call esi
jmp 0x4018d2
xor ebx, ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x20
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 8]
push eax
push str.lbmini_pid
push str.SoftwareKingsoftLBMINI
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x401916
push ebx
push ebx
push 1
push str.lbmini_pid
push str.SoftwareKingsoftLBMINI
push 0x80000001
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40191c
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x83c
push ebx
push esi
push edi
push 0xa
push str.LIEBAOSETUP
push 0
mov byte [esp + 0x1b], dl
mov byte [esp + 0x1a], cl
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x401ad9
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x401ad9
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x401ad9
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [esp + 0x638]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x401ad9
lea edx, [esp + 0x428]
lea ecx, [esp + 0x638]
call fcn.00401334
mov esi, eax
cmp esi, 0xffffffff
je 0x401ad9
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
test ecx, ecx
jg 0x4019d1
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4019c8
sub ecx, edx
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ecx
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esi, 0x206
push esi
mov word [esp + 0x1c], ax
xor ebx, ebx
lea eax, [esp + 0x1e]
push ebx
push eax
call fcn.00401bff
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.00401283
test al, al
je 0x401acb
push str.lbmini.exe
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp + 0x18]
call fcn.00401824
xor eax, eax
mov byte [esp + 0xd], bl
push esi
mov word [esp + 0x224], ax
lea eax, [esp + 0x226]
push ebx
push eax
call fcn.00401bff
add esp, 0xc
lea eax, [esp + 0x18]
mov edx, 0x104
lea ecx, [esp + 0x220]
push eax
call fcn.004011c9
lea eax, [esp + 0xd]
push eax
lea edx, [esp + 0x224]
lea ecx, [esp + 0x42c]
call fcn.00401468
pop ecx
test eax, eax
jne 0x401ac0
xor edx, edx
lea ecx, [esp + 0x220]
call fcn.00401693
cmp byte [esp + 0xd], bl
jne 0x401aa5
mov byte [esp + 0x10], 1
cmp byte [esp + 0xe], bl
je 0x401aa9
mov byte [esp + 0x10], bl
push dword [esp + 0x10]
mov dl, byte [esp + 0x13]
lea ecx, [esp + 0x224]
call fcn.0040137d
pop ecx
jmp 0x401acb
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.00401693
lea eax, [esp + 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401ae2
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
push esi
push eax
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, eax
xor esi, esi
xor al, al
mov dword [ebp - 8], ecx
mov bl, 1
mov byte [ebp + 0x13], al
cmp dword [ebp - 4], esi
jle 0x401b9d
push edi
mov edx, dword [ecx + esi*4]
mov ecx, str.__upgrade
mov eax, edx
mov di, word [eax]
cmp di, word [ecx]
jne 0x401b42
test di, di
je 0x401b3e
mov di, word [eax + 2]
cmp di, word [ecx + 2]
jne 0x401b42
add eax, 4
add ecx, 4
test di, di
jne 0x401b1c
xor eax, eax
jmp 0x401b47
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401b52
mov al, 1
mov byte [ebp + 0x13], al
jmp 0x401b8f
mov eax, str.__disable_shortcut
mov cx, word [edx]
cmp cx, word [eax]
jne 0x401b7d
test cx, cx
je 0x401b79
mov cx, word [edx + 2]
cmp cx, word [eax + 2]
jne 0x401b7d
add edx, 4
add eax, 4
test cx, cx
jne 0x401b57
xor eax, eax
jmp 0x401b82
sbb eax, eax
or eax, 1
xor ecx, ecx
movzx ebx, bl
test eax, eax
mov al, byte [ebp + 0x13]
cmove ebx, ecx
mov ecx, dword [ebp - 8]
inc esi
cmp esi, dword [ebp - 4]
jl 0x401b12
pop edi
mov dl, bl
mov cl, al
call fcn.0040191c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100034c6
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [0x10026fa2], 0x4d29ac2
push 0
mov ebx, 0x108
call fcn.1000d8a0
add esp, 4
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10003514
mov eax, 0x100262c3
push eax
push 2
mov ebx, 0x138
call fcn.1000d940
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000353a
push ebx
call fcn.1000c8a0
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x1000354d
mov eax, 0x100262c3
push eax
push 1
mov ebx, 0x154
call fcn.1000d0f0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x10003573
push ebx
call fcn.1000c8a0
add esp, 4
push str..tmp
push dword [ebp - 0x10]
call fcn.1000152d
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100035a1
push ebx
call fcn.1000c8a0
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x100036a0
push 0x80000004
push 0
push 0x100263ec
push 1
mov ebx, 0x158
call fcn.1000d9b0
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100035f8
push 6
call fcn.1000c8ac
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000360b
push ebx
call fcn.1000c8a0
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0
push 0
push 0
push 6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x10003647
push 6
call fcn.1000c8ac
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 3
mov eax, 0x100263f5
test eax, eax
je 0x1000365e
add eax, 8
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1000367e
push 6
call fcn.1000c8ac
add esp, 4
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x100036a0
push 6
call fcn.1000c8ac
add esp, 4
call fcn.100036b3
mov eax, 0
jmp 0x100036af
mov esp, ebp
pop ebp
ret
Function at 0x10003de2
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [0x10026ffe], 0x4d29ac2
push 0
mov ebx, 0x108
call fcn.1000d8a0
add esp, 4
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10003e30
mov eax, 0x100262c3
push eax
push 2
mov ebx, 0x138
call fcn.1000d940
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10003e56
push ebx
call fcn.1000c8a0
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x10003e69
mov eax, 0x100262c3
push eax
push 1
mov ebx, 0x154
call fcn.1000d0f0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x10003e8f
push ebx
call fcn.1000c8a0
add esp, 4
push str..tmp
push dword [ebp - 0x10]
call fcn.1000152d
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10003ebd
push ebx
call fcn.1000c8a0
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x10003fbc
push 0x80000004
push 0
push 0x100263ec
push 1
mov ebx, 0x158
call fcn.1000d9b0
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10003f14
push 6
call fcn.1000c8ac
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10003f27
push ebx
call fcn.1000c8a0
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0
push 0
push 0
push 6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x10003f63
push 6
call fcn.1000c8ac
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 3
mov eax, 0x100263f5
test eax, eax
je 0x10003f7a
add eax, 8
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10003f9a
push 6
call fcn.1000c8ac
add esp, 4
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x10003fbc
push 6
call fcn.1000c8ac
add esp, 4
call fcn.10003fcf
mov eax, 0
jmp 0x10003fcb
mov esp, ebp
pop ebp
ret
Function at 0x1000909d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x10027016], 0
jne 0x100090d6
push 0x10026c29
push dword [0x10027076]
call fcn.1000152d
add esp, 8
cmp eax, 0
jne 0x100090d6
mov eax, 1
jmp 0x100090db
mov eax, 0
test eax, eax
je 0x10009141
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fild dword [0x1002707a]
fstp qword [ebp - 0x14]
fsub qword [ebp - 0x14]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fsub qword [0x10026c32]
fcomp qword [0x10026340]
fnstsw ax
test ah, 0x41
jne 0x10009141
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
mov dword [0x1002707a], eax
cmp dword [0x10027002], 0
je 0x1000914e
mov esp, ebp
pop ebp
ret 8
Function at 0x1b5a6
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 4
pop esi
push 0x1da7a
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push esi
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
mov edi, 0x24bc8
push edi
call fcn.00011648
push 0x24558
call fcn.0001ab5c
xor eax, eax
mov esi, 0x400
mov word [ebp - 0x10], ax
mov eax, esi
push esi
mov word [ebp - 0xe], ax
call fcn.000153de
xor ebx, ebx
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x1b709
movzx ecx, word [ebp - 0xe]
push ecx
push ebx
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
jl 0x1b680
push 0x1f81c
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
test eax, eax
jl 0x1b680
lea eax, [ebp - 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
push 0xf003f
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0x240
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x1b680
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
push esi
mov word [ebp - 0x10], ax
push ebx
push dword [ebp - 0xc]
mov eax, esi
mov word [ebp - 0xe], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
jl 0x1b701
push 0x1f828
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
test eax, eax
jl 0x1b701
lea eax, [ebp - 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
push 0xf003f
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0x240
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x1b701
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push dword [ebp - 0xc]
call fcn.000153f8
lea eax, [ebp - 0x30]
push eax
push 0xf003f
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0x240
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
pop edi
pop esi
pop ebx
test eax, eax
jl 0x1b758
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
leave
ret
Function at 0x4027b8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4027e7
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004033d4
jmp 0x402805
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.0040274c
mov edi, eax
test ebx, ebx
je 0x402805
cmp dword [esi], 0
je 0x402805
dec ebx
jmp 0x4027ee
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x405854
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
add esp, 0xffffffe8
mov ebx, eax
xor esi, esi
test bl, bl
jbe 0x405875
mov edx, 0x4058ac
mov eax, esp
call fcn.00405918
add bl, 0x40
mov byte [esp], bl
mov esi, esp
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push esi
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x4058a1
mov eax, dword [esp + 8]
imul dword [esp + 0xc]
imul dword [esp + 0x14]
jmp 0x4058a4
or eax, 0xffffffff
add esp, 0x18
pop esi
pop ebx
ret

Function at 0x405e9c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405ed5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004033d4
jmp 0x405ede
mov eax, ebx
mov edx, esi
call fcn.00403388
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405ee8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405f09
mov al, byte [esp]
jmp 0x405f0b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40e2e4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004032f4
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x40e345
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x40e345
cmp byte [ebp - 0x102], 0
je 0x40e345
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403450
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f584
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x24], 0
je 0x40f605
xor eax, eax
mov al, byte [ebx + 4]
mov word [ebp - 6], ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x40f5b6
add word [ebp - 6], 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x40f5c8
add word [ebp - 6], 0x4000
test byte [ebx + 0xb], 0x20
je 0x40f5d4
add word [ebp - 6], 0x8000
xor ebx, ebx
movzx edx, word [ebp - 6]
mov cl, 2
mov eax, dword [ebp - 0xc]
call fcn.0040f45c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40f5f9
push ebp
mov eax, dword [ebp - 4]
call fcn.0040f4f8
pop ecx
mov ebx, eax
cmp bl, 2
je 0x40f5d4
cmp dword [ebp - 4], 0
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417d84
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x417d8a
ret