joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4026cd
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, eax
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
xor edi, edi
cmp dword [ebp - 0xc], edi
mov dword [ebp - 0x10], eax
mov esi, 0x10016
jl 0x40270a
jg 0x4026f8
cmp eax, esi
jbe 0x40270a
mov eax, 0xfffeffea
add dword [ebp - 0x10], eax
push 2
push edi
adc dword [ebp - 0xc], 0xffffffff
push eax
jmp 0x402713
push edi
push edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
push edi
lea ecx, [ebp - 4]
push ecx
push esi
push eax
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x40275d
push 0x16
pop ebx
cmp dword [ebp - 4], ebx
jb 0x40275d
mov eax, dword [ebp - 8]
jbe 0x40275d
mov ecx, dword [eax]
cmp ecx, dword [0x40a09c]
je 0x40276f
dec dword [ebp - 4]
inc eax
add dword [ebp - 0x10], 1
adc dword [ebp - 0xc], edi
cmp dword [ebp - 4], ebx
ja 0x402743
push dword [ebp - 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
xor eax, eax
xor edx, edx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 8]
movzx esi, word [eax + 0x14]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
movzx eax, si
cdq
pop ecx
xor ecx, ecx
sub eax, dword [ebp + 8]
sbb edx, ecx
add eax, dword [ebp - 0x10]
adc edx, dword [ebp - 0xc]
add eax, ebx
adc edx, edi
jmp 0x40276a

Function at 0x402825
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
lea esi, [ebp - 0x10]
mov edi, eax
call fcn.00401de1
mov eax, esi
push eax
mov eax, edi
call fcn.00402793
mov esi, eax
mov al, byte [esi]
test al, al
pop ecx
je 0x402910
xor edi, edi
inc edi
jmp 0x402860
cmp al, 0x20
ja 0x402864
inc esi
mov al, byte [esi]
test al, al
jne 0x402859
mov al, byte [esi]
cmp al, 0x2d
je 0x402880
cmp al, 0x2f
je 0x402880
push 0x40a240
mov eax, esi
call fcn.00402793
pop ecx
jmp 0x402904
inc esi
movsx eax, byte [esi]
or eax, 0x20
sub eax, 0x61
je 0x4028f0
dec eax
je 0x4028e8
dec eax
je 0x4028da
sub eax, 0xa
je 0x4028cd
sub eax, 6
je 0x4028ac
dec eax
jne 0x402910
mov dword [0x40a228], edi
inc esi
jmp 0x402906
cmp al, 0x20
ja 0x4028b3
inc esi
mov al, byte [esi]
test al, al
jne 0x4028a8
push esi
call dword [sym.imp.MSVCRT.dll_atoi]
and eax, 7
pop ecx
mov dword [0x40a268], eax
jmp 0x4028c6
inc esi
cmp byte [esi], 0x20
ja 0x4028c5
jmp 0x402906
or dword [0x40a268], edi
mov edx, 0x40a26c
jmp 0x4028fc
or dword [0x40a268], 2
mov edx, 0x40a27c
jmp 0x4028fc
mov dword [0x40a22c], edi
jmp 0x4028a5
or dword [0x40a268], 4
mov edx, 0x40a28c
lea eax, [esi + 1]
call fcn.004027f9
mov esi, eax
mov al, byte [esi]
test al, al
jne 0x402859
push dword [ebp - 0x10]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
leave
ret
Function at 0x402b9c
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov esi, eax
call fcn.00401de1
mov eax, dword [esp + 0xc]
push dword [esp + 0x10]
mov eax, dword [eax + 0x3c]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
push eax
call fcn.00401e4c
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
or eax, 0xffffffff
call fcn.00401ea6
pop edi
mov eax, esi
pop esi
ret 8

Function at 0x402e36
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0x40]
test eax, eax
je 0x402e53
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
and dword [esi + 0x40], 0
ret

Function at 0x402f1a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, eax
push edi
mov esi, ebx
call fcn.00402e36
push 0x3e9
push ebx
lea eax, [esp + 0x18]
call fcn.00402b9c
lea esi, [ebx + 0x44]
mov edi, eax
call fcn.00401e00
push dword [esp + 0x10]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
lea edi, [ebx + 0x44]
push dword [edi]
call fcn.00401341
xor esi, esi
cmp edx, esi
pop ecx
jl 0x402f82
jg 0x402f69
cmp eax, esi
jb 0x402f82
lea eax, [esp + 0xc]
push eax
push esi
push ebx
push 0x402e01
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebx + 0x40], eax
jmp 0x402fad
push 0x409244
push 0x3eb
push dword [ebx + 0x3c]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ebx, dword [ebx + 0x3c]
push esi
push esi
push 0x470
push ebx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [0x40a240]
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
je 0x402ff3
mov eax, dword [0x40a26c]
mov word [eax], si
mov eax, dword [0x40a27c]
mov dword [0x40a274], esi
mov word [eax], si
mov eax, dword [0x40a28c]
mov dword [0x40a284], esi
mov word [eax], si
mov dword [0x40a294], esi
mov esi, 0x40a240
call fcn.00401e00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403ea6
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0x40]
test eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
je 0x403ec6
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push dword [esi + 0x40]
call edi
and dword [esi + 0x40], 0
mov eax, dword [0x40a1fc]
cmp eax, 0xffffffff
je 0x403eda
push eax
call edi
or dword [0x40a1fc], 0xffffffff
pop edi
ret
Function at 0x4043d4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
cmp dword [0x40a2a4], 0x77073096
je 0x404410
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
test cl, 1
je 0x4043fa
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x4043fc
shr ecx, 1
dec esi
jne 0x4043eb
mov dword [edx*4 + 0x40a2a0], ecx
inc edx
cmp edx, 0x100
jb 0x4043e6
pop esi
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x404439
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x40a2a0]
inc ecx
cmp ecx, dword [esp + 8]
jb 0x404418
not eax
ret
Function at 0x40292c
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402969
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402989
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404bd4
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402b8c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040496c
test esi, esi
jne 0x402bc2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404a5c
jmp 0x402be0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402aa0
mov edi, eax
test esi, esi
je 0x402be0
cmp dword [ebx], 0
je 0x402be0
dec esi
jmp 0x402bc9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403230
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x496008], 0x8088405
inc edx
mov dword [ebx + 0x496008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4039f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x496010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403a8c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403a6c
xor eax, eax
push ebp
push 0x403a65
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403aa8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a6c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x496010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x496010], ax
mov esp, ebp
pop ebp
ret

Function at 0x40476c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49804c], 0
je 0x4047cd
cmp word [0x498220], 0xd7b2
jne 0x404795
cmp dword [0x498228], 0
jbe 0x404795
mov eax, 0x49821c
call dword [0x498238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x496058
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4047f4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x496020], 0
jne 0x4047e9
push 0
push 0x496078
push 0x496058
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404920
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040275c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x49804d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4048e8
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4062d4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406504
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406357
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406504
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406357
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406520
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4063e0
xor eax, eax
push ebp
push 0x4063d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0040611c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4063be
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406540
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4063be
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4063e0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4064fa
cmp byte [ebp - 0xd], 0
jne 0x406427
cmp byte [ebp - 0x12], 0
je 0x4064fa
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406440
dec ebx
cmp byte [ebx], 0x2e
je 0x40644f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40643f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4064fa
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40648c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4064fa
cmp byte [ebp - 0xd], 0
je 0x4064fa
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4064fa
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409244
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404e1c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40925d
test al, 0x10
jne 0x409261
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40bfb4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bfed
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404a5c
jmp 0x40bff6
mov eax, ebx
mov edx, esi
call fcn.004049c0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c000
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c021
mov al, byte [esp]
jmp 0x40c023
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c6a8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c520
mov eax, dword [0x497480]
cmp byte [eax], 0
je 0x40c710
mov eax, dword [0x49727c]
call fcn.0040301c
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004096d0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c758
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c746
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x497230]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x498718]
call fcn.004060e0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40d590
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d5f4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404bd4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409038
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d5fb
lea eax, [ebp - 0xc]
call fcn.0040496c
ret

Function at 0x41f124
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041efc4
dec esi
jne 0x41f146
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x420270
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x498a28
cmp dword [edi], 0
jne 0x4202ec
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x498a24]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x496510
mov ecx, 2
call fcn.00402a60
mov edx, 0x420248
lea eax, [esi + 5]
call fcn.00420268
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00420268
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4202c1
mov dword [0x498a24], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x421808
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42180e
ret

Function at 0x424050
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4240a1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x424088
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x424078
jmp 0x4240a1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x424089
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435d00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x435dff
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00445bc0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x210], 0
je 0x435de9
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x220]
cmp eax, 0x1f4
jb 0x435d5d
mov eax, dword [ebp - 4]
add eax, 0x21c
call fcn.0040496c
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x220], eax
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 8
je 0x435d93
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dl, byte [edx]
call fcn.00404b4c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, 0x21c
call fcn.00404c2c
jmp 0x435db5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x21c]
call fcn.00404c24
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0x21c
mov ecx, 1
call fcn.00404ebc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x21c]
call fcn.00404c24
test eax, eax
jle 0x435dd0
push ebp
call fcn.00435c18
pop ecx
jmp 0x435de9
xor edx, edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebp - 4]
mov si, 0xffeb
call fcn.00403d78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435e06
lea eax, [ebp - 0xc]
call fcn.0040496c
ret

Function at 0x43a9f4
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x43a940
call sub.user32.dll_EnumWindows
ret

Function at 0x43ab18
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x43ab95
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0043a564
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x43ab3d
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0043a1bc
cmp dword [ebp - 4], 0
je 0x43ab7f
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404e1c
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ab9c
lea eax, [ebp - 4]
call fcn.0040496c
ret
Function at 0x43df3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x498bb8], 0
je 0x43e08b
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x497408]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x43e08b
mov eax, dword [0x498bbc]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x498bb8]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x43e05a
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x498bb8]
call fcn.00416c40
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x43e052
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x43e052
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x43e052
mov eax, dword [ebp - 0x14]
call fcn.00446b90
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43e052
push ebp
call fcn.0043def8
pop ecx
test al, al
jne 0x43e052
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x43e00e
mov eax, dword [ebp - 0x14]
call fcn.00445724
dec eax
jle 0x43e052
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00403d78
cmp byte [ebp - 1], 0
je 0x43e052
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x43e052
mov edx, dword [ebp - 0x14]
mov eax, dword [0x498bbc]
call fcn.0043d6c0
inc edi
dec ebx
jne 0x43dfa1
mov eax, dword [0x498bbc]
cmp dword [eax + 8], 0
jle 0x43e072
mov eax, dword [0x498bbc]
call fcn.0043d750
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43e08b
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0043dd60
pop ecx
test al, al
jne 0x43e08b
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret