joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e6e40
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [eax + 0x18c]
xor edi, edi
test eax, eax
je 0x100e6e5e
mov eax, dword [eax + 0xf4]
mov edi, dword [eax + 4]
mov ebx, dword [sym.imp.USER32.dll_OpenClipboard]
xor esi, esi
push edi
call ebx
test eax, eax
jne 0x100e6e84
push 0xa
call fcn.100d26e0
inc esi
add esp, 4
cmp esi, 3
jl 0x100e6e66
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x100e7090
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push ebx
push edi
push eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push dword [ebp + 0xc]
push dword [eax + 0x1a4]
mov eax, dword [eax + 0x19c]
call eax
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x100e720e
mov eax, dword [ebp - 4]
test eax, eax
je 0x100e720e
push eax
push ecx
push 0x1012e9d8
push str.UTF_16LE
call fcn.1008e3c0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x100e70f7
push str.Couldnt_convert_text_from_UTF_8
call fcn.10067d40
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
movzx edx, word [edi]
xor eax, eax
xor ecx, ecx
push esi
test dx, dx
je 0x100e7126
mov esi, edi
cmp dx, 0xa
jne 0x100e7118
test ecx, ecx
je 0x100e7117
cmp word [esi - 2], 0xd
je 0x100e7118
inc eax
inc ecx
inc eax
movzx edx, word [edi + ecx*2]
lea esi, [edi + ecx*2]
test dx, dx
jne 0x100e7106
lea eax, [eax*2 + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x100e71e4
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
test ecx, ecx
je 0x100e71b6
movzx eax, word [edi]
xor esi, esi
mov edx, eax
mov dword [ebp + 8], edx
test ax, ax
je 0x100e71aa
mov edx, edi
movzx ebx, ax
movzx eax, bx
mov dword [ebp + 8], eax
movzx eax, ax
cmp bx, 0xa
jne 0x100e7192
test esi, esi
je 0x100e7184
cmp word [edx - 2], 0xd
mov eax, dword [ebp + 8]
movzx eax, ax
je 0x100e7192
mov eax, 0xd
mov word [ecx], ax
add ecx, 2
movzx eax, word [edx]
inc esi
mov word [ecx], ax
movzx eax, word [edi + esi*2]
lea edx, [edi + esi*2]
add ecx, 2
mov ebx, eax
test ax, ax
jne 0x100e7164
mov ebx, dword [ebp - 8]
xor eax, eax
push ebx
mov word [ecx], ax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x100e7202
push str.Couldnt_set_clipboard_data
call fcn.100e5430
add esp, 4
mov ebx, eax
push edi
call fcn.100966a0
add esp, 4
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call fcn.10067c90
add esp, 4
mov ebx, eax
push edi
call fcn.100966a0
add esp, 4
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
xor ebx, ebx
call fcn.100966a0
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e84e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0xf4]
mov eax, dword [edi + 4]
mov dword [ebp - 4], eax
call fcn.10094e30
xor ebx, ebx
cmp eax, esi
sete bl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [ebp - 4]
sete cl
cmp ebx, ecx
je 0x100e86e9
cmp ecx, dword [ebp + 0xc]
jne 0x100e86e9
test ecx, ecx
je 0x100e867f
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
neg eax
push 1
sbb esi, esi
neg esi
call ebx
mov edx, 4
lea ecx, [edx - 3]
test ax, ax
je 0x100e855a
test esi, esi
mov eax, edx
cmove eax, ecx
or byte [edi + 0x44], al
push 2
call ebx
test ax, ax
je 0x100e8575
test esi, esi
mov eax, 1
mov ecx, 4
cmove eax, ecx
or byte [edi + 0x44], al
push 4
call ebx
test ax, ax
je 0x100e8582
or byte [edi + 0x44], 2
push 5
call ebx
test ax, ax
je 0x100e858f
or byte [edi + 0x44], 8
push 6
call ebx
test ax, ax
je 0x100e859c
or byte [edi + 0x44], 0x10
mov eax, dword [edi + 0xb0]
test eax, eax
mov ebx, dword [ebp + 8]
mov ecx, ebx
cmovne ecx, eax
push ecx
call fcn.100955e0
add esp, 4
call fcn.10097360
cmp dword [eax + 0x4c], 0
jne 0x100e8603
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ScreenToClient]
cvtsi2ss xmm0, dword [ebp - 8]
sub esp, 8
movss dword [esp + 4], xmm0
cvtsi2ss xmm0, dword [ebp - 0xc]
movss dword [esp], xmm0
push 0
push 0
push ebx
call fcn.100e79c0
push edx
push eax
call fcn.100984e0
add esp, 0x1c
push edi
call fcn.100e79c0
push edx
push eax
call fcn.100e74f0
push ebx
call fcn.100f53e0
push dword [edi + 0xb4]
call fcn.100e6b70
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
add esp, 0x14
push 0x14
call esi
and eax, 1
push eax
push 0x2000
call fcn.100958a0
add esp, 8
push 0x90
call esi
and eax, 1
push eax
push 0x1000
call fcn.100958a0
add esp, 8
push 0x91
call esi
and eax, 1
push eax
push 0x8000
call fcn.100958a0
push 1
push dword [edi]
call fcn.100f5780
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
mov dword [edi + 0x60], 1
call fcn.100955e0
add esp, 4
call fcn.10097360
cmp dword [eax + 0x4c], 0
je 0x100e86a5
push 0
call fcn.100987a0
add esp, 4
call fcn.100ecf70
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetClipCursor]
test eax, eax
je 0x100e86e2
push 0x10
lea esi, [edi + 0x64]
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.100cb880
add esp, 0xc
test eax, eax
jne 0x100e86e2
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [edi + 0x60], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e9dc0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, 0xff7f
shr edx, 0x10
movzx eax, dl
and ax, cx
movzx ecx, ax
test cx, cx
je 0x100e9dfa
test edx, 0x100
je 0x100e9dee
or eax, 0xe000
movzx ecx, ax
jmp 0x100e9e28
cmp ecx, 0x45
jne 0x100e9e28
mov ecx, 0xe046
jmp 0x100e9e28
call fcn.100e5080
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
push eax
movzx eax, word [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx ecx, ax
mov edx, 0xe11d
cmp cx, dx
mov eax, 0xe046
cmove ecx, eax
mov eax, ecx
movzx ecx, cl
shr eax, 8
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x80
or eax, ecx
mov eax, dword [eax*4 + 0x1015b550]
pop ebp
ret

Function at 0x100eb990
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, word [ebx + 0xec]
push 0
push 0
push dword [ebp + 0x10]
mov dword [ebp + 8], eax
push edi
call sub.IMM32.dll_ImmGetCompositionStringW
mov esi, eax
test esi, esi
jle 0x100eb9e0
cmp dword [ebx + 0x78], esi
jge 0x100eb9e0
mov eax, dword [ebx + 0x74]
test eax, eax
je 0x100eb9ce
push eax
call fcn.100966a0
add esp, 4
lea eax, [esi + 2]
push eax
call fcn.100966d0
add esp, 4
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x78], esi
push dword [ebx + 0x78]
push dword [ebx + 0x74]
push dword [ebp + 0x10]
push edi
call sub.IMM32.dll_ImmGetCompositionStringW
mov esi, eax
xor eax, eax
push eax
push eax
test esi, esi
push 0x80
cmovs esi, eax
push edi
shr esi, 1
call sub.IMM32.dll_ImmGetCompositionStringW
movzx edx, ax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x9c], edx
cmp eax, 0x404
je 0x100eba21
cmp eax, 0x804
jne 0x100eba5b
test edx, edx
je 0x100eba5b
mov eax, dword [ebx + 0x78]
shr eax, 1
cmp edx, eax
jae 0x100eba5b
mov eax, dword [ebx + 0x74]
mov ecx, 0x3000
movzx eax, word [eax]
cmp ax, cx
je 0x100eba43
cmp eax, 0x20
jne 0x100eba5b
inc edx
cmp edx, esi
jae 0x100eba5a
mov eax, dword [ebx + 0x74]
lea ecx, [eax + edx*2]
inc edx
mov ax, word [ecx]
mov word [ecx - 2], ax
cmp edx, esi
jl 0x100eba48
dec esi
mov eax, dword [ebx + 0x74]
xor ecx, ecx
mov word [eax + esi*2], cx
cmp dword [ebx + 0x9c], ecx
jne 0x100ebae4
test esi, esi
jle 0x100ebae4
xor esi, esi
push esi
push esi
push 0x10
push edi
call sub.IMM32.dll_ImmGetCompositionStringW
mov edi, eax
test edi, edi
jle 0x100ebade
lea ecx, [edi + 2]
push ecx
call fcn.100966d0
add esp, 4
mov esi, eax
mov dword [ebp + 8], esi
push edi
push esi
push 0x10
push dword [ebp + 0xc]
call sub.IMM32.dll_ImmGetCompositionStringW
xor ecx, ecx
mov al, byte [esi + ecx]
cmp al, 1
je 0x100ebab1
cmp al, 3
je 0x100ebab1
inc ecx
cmp ecx, edi
jl 0x100ebaa1
mov edx, dword [ebp + 8]
mov esi, ecx
cmp ecx, edi
jge 0x100ebad2
lea ebx, [ebx]
mov al, byte [edx + esi]
cmp al, 1
je 0x100ebacb
cmp al, 3
jne 0x100ebad5
inc esi
cmp esi, edi
jl 0x100ebac0
cmp ecx, edi
cmove esi, edi
push edx
call fcn.100966a0
add esp, 4
mov dword [ebx + 0x9c], esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100ec640
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0
movzx edi, word [esi + 0xec]
and edi, 0x3ff
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, dword [esi + 0xec]
cmp eax, ecx
je 0x100ec698
movzx edx, ax
mov ecx, edx
mov dword [esi + 0xec], eax
and ecx, 0x3ff
cmp ecx, 0x12
je 0x100ec68e
mov ecx, 0x804
cmp dx, cx
je 0x100ec68e
mov ecx, 1
jmp 0x100ec690
xor ecx, ecx
mov dword [esi + 0xbc], ecx
mov ecx, eax
cmp dword [esi + 0x10c], 0
jne 0x100ec6b2
xor eax, eax
cmp ecx, 0xe0060404
setne al
mov dword [esi + 0xb8], eax
push esi
call fcn.100ec7d0
movzx eax, word [esi + 0xec]
add esp, 4
and eax, 0x3ff
cmp edi, eax
je 0x100ec6d4
push esi
call fcn.100eb700
add esp, 4
pop edi
pop esi
pop ebp
ret
Function at 0x100f0160
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
fild dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
fstp dword [ebp + 8]
fld dword [ebp + 8]
fdiv qword [0x1015c5d0]
push str.Control_PanelMouse
push 0x80000001
mov dword [ebp - 0xc], 3
mov dword [ebp - 8], 0x28
fstp dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100f0331
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.SmoothMouseXCurve
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100f0328
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.100ef8b0
add esp, 8
test eax, eax
je 0x100f0328
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.SmoothMouseYCurve
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100f0328
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.100ef8b0
add esp, 8
test eax, eax
je 0x100f0328
movss xmm1, dword [ebp - 0x24]
xorps xmm0, xmm0
comiss xmm1, xmm0
jbe 0x100f024d
fld dword [ebp - 0x10]
fld dword [ebp - 0x38]
fdiv dword [ebp - 0x24]
fmul st(1)
fstp dword [ebp + 8]
jmp 0x100f0257
fld dword [ebp - 0x10]
mov dword [ebp + 8], 0
fld dword [ebp + 8]
fld qword [0x1015c5c8]
fdiv st(1), st(0)
fxch st(1)
movss dword [ebp - 0x60], xmm1
movss xmm1, dword [ebp - 0x20]
comiss xmm1, xmm0
fstp dword [ebp - 0x5c]
jbe 0x100f0283
fld dword [ebp - 0x34]
fdiv dword [ebp - 0x20]
fmul st(2)
fstp dword [ebp + 8]
jmp 0x100f028a
mov dword [ebp + 8], 0
fld dword [ebp + 8]
fdiv st(1)
movss dword [ebp - 0x58], xmm1
movss xmm1, dword [ebp - 0x1c]
comiss xmm1, xmm0
fstp dword [ebp - 0x54]
jbe 0x100f02ae
fld dword [ebp - 0x30]
fdiv dword [ebp - 0x1c]
fmul st(2)
fstp dword [ebp + 8]
jmp 0x100f02b5
mov dword [ebp + 8], 0
fld dword [ebp + 8]
fdiv st(1)
movss dword [ebp - 0x50], xmm1
movss xmm1, dword [ebp - 0x18]
comiss xmm1, xmm0
fstp dword [ebp - 0x4c]
jbe 0x100f02d9
fld dword [ebp - 0x2c]
fdiv dword [ebp - 0x18]
fmul st(2)
fstp dword [ebp + 8]
jmp 0x100f02e0
mov dword [ebp + 8], 0
fld dword [ebp + 8]
fdiv st(1)
movss dword [ebp - 0x48], xmm1
movss xmm1, dword [ebp - 0x14]
comiss xmm1, xmm0
fstp dword [ebp - 0x44]
jbe 0x100f0306
fld dword [ebp - 0x28]
fdiv dword [ebp - 0x14]
fmulp st(2)
fxch st(1)
fstp dword [ebp + 8]
jmp 0x100f030f
fstp st(1)
mov dword [ebp + 8], 0
fdivr dword [ebp + 8]
lea eax, [ebp - 0x60]
push eax
push 0xa
movss dword [ebp - 0x40], xmm1
fstp dword [ebp - 0x3c]
call fcn.10098850
add esp, 8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x100f2ff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
push 0x80000001
mov esi, 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100f3065
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.AppsUseLightTheme
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100f305c
cmp dword [ebp - 4], 0
mov eax, 2
cmove esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10121e4e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10121cc4

Function at 0x1001723
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001150
call fcn.010018c0
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x100175e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100175e
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1001776
cmp eax, 0x20b
je 0x1001763
mov dword [ebp - 0x1c], edi
jmp 0x100178a
cmp dword [ecx + 0x84], 0xe
jbe 0x100175e
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1001784
cmp dword [ecx + 0x74], 0xe
jbe 0x100175e
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1003014], 0xffffffff
or dword [0x1003018], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1003010]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100300c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100301c], eax
call fcn.010018bc
cmp dword [section..data], edi
jne 0x10017e5
push fcn.010018bc
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010018aa
push 0x10010fc
push 0x10010f8
call sub.msvcrt.dll__initterm
mov eax, dword [0x1003008]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1003004]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x10010f4
push 0x10010f0
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.010011bc
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x100185c
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1001891
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.010018f9
ret
Function at 0x406cd0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4795fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046e525
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x406d52
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046c437
mov eax, dword [eax]
push 0x10f9c58
push eax
call fcn.0045f134
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046e7b0
test bl, bl
je 0x406d52
push 0x10f9c58
lea ecx, [esp + 0xc]
call fcn.0046eb40
push 0x10f9c64
lea ecx, [esp + 0xc]
call fcn.0046eb40
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x406d8e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046e7b0
jmp 0x406e59
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x406e12
lea edx, [esp + 0x7c]
push 0x10f9c60
push edx
call fcn.0045f134
add esp, 8
test eax, eax
je 0x406e12
lea eax, [esp + 0x7c]
push 0x10f9c5c
push eax
call fcn.0045f134
add esp, 8
test eax, eax
je 0x406e12
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406da2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046e7b0
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x407660
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4076c2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4076d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47967b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x11035d0]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x407808
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x407736
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046e7b0
xor eax, eax
jmp 0x40787f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046e8ed
push esi
lea ecx, [esp + 0xc]
call fcn.0046eb7c
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x10f9c98
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40785d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.00407660
test eax, eax
jne 0x40785d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.00407660
test eax, eax
jne 0x40785d
lea eax, [esp + 0x14]
push 0x10f9c74
push eax
call fcn.004601b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40783c
lea ecx, [esp + 0x14]
push 0x10f9c70
push ecx
call fcn.00460130
mov esi, eax
add esp, 8
test esi, esi
jne 0x40783c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40783f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046e89d
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40774e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046e7b0
xor eax, eax
jmp 0x40787f
mov byte [esi], 0
push 0x10f9c6c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046e7b0
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x417ff0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41805e
cmp si, 0x69
ja 0x41805e
add esi, 0xffd0
cmp si, 0x11
je 0x41802e
push 0x11
call edi
test ax, ax
jge 0x41802e
or esi, 0x2000
cmp si, 0x10
je 0x418043
push 0x10
call edi
test ax, ax
jge 0x418043
or esi, 0x4000
cmp si, 0x12
je 0x418058
push 0x12
call edi
test ax, ax
jge 0x418058
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41806b
mov esi, 0xbd
jmp 0x41801f
cmp si, 0x6e
jne 0x418078
mov esi, 0xbe
jmp 0x41801f
cmp si, 0x6f
jne 0x418019
mov esi, 0xbf
jmp 0x41801f

Function at 0x419860
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x1113d20]
xor edx, edx
cmp eax, edx
jne 0x419886
xor eax, eax
mov byte [eax + 0x1113c20], al
inc eax
cmp eax, 0x100
jl 0x41986e
mov dword [0x1113d20], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x1113c20
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x419917
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4198ea
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4198b8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x419990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4199e3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4199ca
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret