joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x4bade0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x94000]
push edi
or ebp, 0xffffffff
jmp 0x4bae02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4bae09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4badf8
mov eax, 1
add ebx, ebx
jne 0x4bae1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4bae2c
jne 0x4bae4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bae4b
dec eax
add ebx, ebx
jne 0x4bae38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4bae10
add ebx, ebx
jne 0x4bae47
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4bae9d
xor ecx, ecx
sub eax, 3
jb 0x4bae63
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4baed2
sar eax, 1
mov ebp, eax
jmp 0x4bae6e
add ebx, ebx
jne 0x4bae6e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bae3c
inc ecx
add ebx, ebx
jne 0x4bae7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bae3c
add ebx, ebx
jne 0x4bae89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4bae7e
jne 0x4bae9a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4bae7e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4baebc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4baeae
jmp 0x4badfe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4baebc
add edi, ecx
jmp 0x4badfe
pop esi
mov edi, esi
mov ecx, 0xbaf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4baeda
cmp byte [edi], 0xa
jne 0x4baeda
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4baedf
lea edi, [esi + 0xb8000]
mov eax, dword [edi]
or eax, eax
je 0x4baf4e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc20fc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc2138]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4baf0c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc2140]
or eax, eax
je 0x4baf48
mov dword [ebx], eax
add ebx, 4
jmp 0x4baf29
call dword [esi + 0xc213c]
mov ebp, dword [esi + 0xc2144]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4baf82
sub esp, 0xffffff80
jmp 0x40e45b
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x41cee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
or ebp, 0xffffffff
jmp 0x41cf02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41cf09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41cef8
mov eax, 1
add ebx, ebx
jne 0x41cf1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41cf10
jne 0x41cf2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf10
xor ecx, ecx
sub eax, 3
jb 0x41cf40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41cfb2
mov ebp, eax
add ebx, ebx
jne 0x41cf4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41cf58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41cf7c
inc ecx
add ebx, ebx
jne 0x41cf68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41cf5d
jne 0x41cf79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41cf9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41cf8d
jmp 0x41cefe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41cf9c
add edi, ecx
jmp 0x41cefe
pop esi
mov edi, esi
mov ecx, 0x157
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41cfba
cmp byte [edi], 0
jne 0x41cfba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41cfbf
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41d02e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d0b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d100]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41cfec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d104]
or eax, eax
je 0x41d028
mov dword [ebx], eax
add ebx, 4
jmp 0x41d009
call dword [esi + 0x1d108]
popal
jmp 0x403ab4
Function at 0x298072e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x29876b48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x29807306
xor eax, eax
jmp 0x298073c1
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x29807328
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x29807328
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x298073c1
cmp dword [esi + 0x4c], 0
je 0x298073bf
call fcn.29806a7d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x29807352
push dword [esi + 0x4c]
push eax
call fcn.29813a90
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x298073bf
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x298073bf
cmp eax, 1
jle 0x2980738d
cmp eax, 3
jne 0x298073bf
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x29807344
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x298073b1
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x298073bf
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x298073c1
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.29801cc0
leave
ret 4
Function at 0x29813a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x29813a9f
pop dword [ebp - 0x20]
mov eax, 0xa3190b3e
add eax, 0x86682f61
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x349e2cb5
add dword [ebp - 0x30], 0x19b41896
mov dword [ebp - 0x2c], 0x3e80c3d7
add dword [ebp - 0x2c], 0xf3b2886e
mov dword [ebp - 0x28], 0xb921d1e0
sub dword [ebp - 0x28], 0x6cd58db2
mov dword [ebp - 0x24], 0xc9b5b143
sub dword [ebp - 0x24], 0xc9b5b143
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xd2234489
sub dword [ebp - 0x30], 0x5db0db33
mov dword [ebp - 0x2c], 0xad3ccccf
add dword [ebp - 0x2c], 0x942f94a6
mov dword [ebp - 0x28], 0xfbd35328
add dword [ebp - 0x28], 0x679c1944
mov dword [ebp - 0x24], 0xeb03b82d
sub dword [ebp - 0x24], 0xeb03b82d
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x49fd1
push 0
call eax
mov ecx, 0xf8b6366e
add ecx, 0x74a1958
mov ebx, eax
mov esi, 0xf360628b
add esi, 0x36290175
add esi, dword [ebp - 0x20]
mov edi, 0x289a5766
sub edi, 0xb5ef64da
sub dword [ebp - 0x18], 0xf4fefe71
mov edx, dword [esi]
sub dword [ebp - 0x14], ecx
xor edx, edi
add dword [ebp - 8], eax
mov dword [ebx], edx
add dword [ebp - 8], edx
add ebx, 4
add esi, 0x9f79bf82
sub esi, 0x9f79bf7e
loop 0x29813bb7
add eax, 0x131eb
xor ebx, ebx
add ebx, eax
add eax, 0xea359fb1
sub eax, 0xea359fac
mov ecx, 0x269c80c
sub ecx, 0xd8e9c80c
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x29826d7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x29854690
call fcn.2985114e
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x29826f9e
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.29813a90
add esp, 0x10
test eax, eax
js 0x29826f98
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x29826e21
push edi
call fcn.29827ddd
pop ecx
test al, al
je 0x29826e21
mov eax, edi
call fcn.29851670
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x29826e33
push edi
lea ecx, [ebp - 0x424]
call fcn.29813a90
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.29813a90
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x29826f98
push 0x60
push ebx
push eax
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x29826e8b
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x29826e8b
call fcn.29825061
mov ebx, eax
jmp 0x29826f67
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x29826eb2
call fcn.29825061
jmp 0x29826f5a
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x29826ea8
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x29826ee5
mov ebx, 0x8007000e
jmp 0x29826f5c
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.29813a90
jmp 0x29826f0b
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x29826ede
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.29813a90
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.29813a90
mov ebx, eax
test edi, edi
je 0x29826f67
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x29826f80
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826f90
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826f86
mov eax, ebx
jmp 0x29826fcc
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x29826fb3
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826fc3
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826fb9
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.29851106
ret 0x10
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000983f
pop dword [ebp - 0x40]
mov eax, 0xa4506bc8
sub eax, 0x944fd389
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x33c1b
push 0
mov eax, 0x209e003b
sub eax, 0x109cbfd7
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xfc44af1d
add ecx, 0x3bb83e8
xor edi, edi
add edi, eax
mov ebx, 0x6f04a05f
add ebx, 0xa0fce5a1
add ebx, dword [ebp - 0x40]
mov esi, 0xf6f2205e
add dword [ebp - 0x34], 0x6d9dbbee
mov edx, dword [ebx]
xor dword [ebp - 0x20], 0x60e2317e
xor edx, esi
mov dword [ebp - 0x28], 0x2bd6b4f4
mov dword [edi], edx
add edi, 4
add ebx, 4
loop 0x1000989a
add eax, 0xbee7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4018ff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp + 0xc]
push esi
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x401958
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x401a91
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push edi
mov ebx, ecx
call esi
mov edi, eax
mov ecx, ebx
call fcn.00401ac3
test eax, eax
je 0x401abd
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
sub eax, edi
cmp eax, dword [esp + 0x10]
jbe 0x401aa0
pop edi
pop esi
pop ebx
ret 4

Function at 0x40584b
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4e26bc
call fcn.004bb144
sub esp, 0x110
push esi
mov esi, ecx
and dword [ebp - 4], 0
push 0x531e08
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.004d813d
mov ecx, esi
call fcn.00405bcf
cmp eax, 1
jne 0x405942
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x531f0c
call fcn.004d813d
mov ecx, esi
call fcn.00405da1
lea eax, [ebp - 0x11c]
push 0x105
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0x14]
push eax
call fcn.004d8436
push str.MacromedFlashFlash.ocx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004d8436
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
call fcn.004d87e0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
cmp esi, 0x20
jae 0x4058fe
xor esi, esi
jmp 0x40591a
push str.DllRegisterServer
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x405910
call eax
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push 1
pop esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004d83c8
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004d83c8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004d83c8
mov eax, esi
jmp 0x405950
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004d83c8
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x405da1
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4e2708
call fcn.004bb144
sub esp, 0x58
push ebx
push esi
push 0x44
xor ebx, ebx
pop esi
lea eax, [ebp - 0x64]
push esi
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004bb170
push 0x10
lea eax, [ebp - 0x20]
push ebx
push eax
mov dword [ebp - 0x64], esi
call fcn.004bb170
add esp, 0x18
lea ecx, [ebp - 0x10]
push str.RUNDLL32.EXE_SETUPAPI.DLL_InstallHinfSection_DefaultInstall_132
call fcn.004d8436
push 0x531f0c
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004d87e0
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x10]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004d87f8
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x405e31
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004d83c8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004d83c8
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40900b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eaf78
push 0x4bcd04
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
or dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
push dword [ebp - 0x28]
call fcn.004bd1d0
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
jmp 0x40908a
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409169
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4e2a58
call fcn.004bb144
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0x20
xor eax, eax
pop edx
mov dword [ebp - 4], eax
push 1
mov dword [esi], 0x4eafa0
pop ecx
mov dword [esi + 0x20], edx
push eax
push edx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], ecx
push 8
push 8
mov ecx, esi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], eax
mov dword [esi + 4], eax
mov dword [esi + 0x30], eax
call fcn.00409210
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40cc9e
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
and dword [esi + 0x20], 0
and byte [edi], 0
cmp dword [esi + 0x24], 0
je 0x40ce35
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa0
call ebp
mov ebx, 0x8000
and ax, bx
cmp ax, bx
je 0x40cce6
push 0xa1
call ebp
and ax, bx
cmp ax, bx
je 0x40cce6
xor cl, cl
jmp 0x40cce8
mov cl, 1
mov eax, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esi + 0x1c], ebx
sub eax, 8
mov byte [edi], 1
je 0x40cdc5
sub eax, 0x1b
je 0x40cdab
dec eax
je 0x40cd97
dec eax
je 0x40cd70
dec eax
dec eax
je 0x40cd45
sub eax, 7
je 0x40cd20
and byte [edi], bl
jmp 0x40ce1b
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
cmp ecx, eax
jne 0x40cdcf
mov edx, dword [esi + 8]
lea ecx, [esi + 8]
cmp eax, dword [edx - 8]
jge 0x40ce0f
push 1
push eax
jmp 0x40cdfd
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x10]
cmp eax, dword [edx - 8]
jge 0x40cd5b
inc eax
test cl, cl
mov dword [esi + 0x10], eax
jne 0x40cd5b
mov dword [esi + 0x14], eax
cmp dword [esi + 0x64], ebx
je 0x40ce1b
mov dword [esi + 0x1c], 3
jmp 0x40ce1b
mov eax, dword [esi + 0x10]
cmp eax, ebx
jle 0x40cd82
dec eax
test cl, cl
mov dword [esi + 0x10], eax
jne 0x40cd82
mov dword [esi + 0x14], eax
cmp dword [esi + 0x64], ebx
je 0x40ce1b
mov dword [esi + 0x1c], 2
jmp 0x40ce1b
cmp dword [esi + 0x64], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
je 0x40ce1b
mov dword [esi + 0x1c], 4
jmp 0x40ce1b
mov eax, dword [esi + 8]
cmp dword [esi + 0x64], ebx
mov eax, dword [eax - 8]
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
je 0x40ce1b
mov dword [esi + 0x1c], 5
jmp 0x40ce1b
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
cmp ecx, eax
je 0x40cdec
push ecx
push eax
mov ecx, esi
call fcn.0040ce3c
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
cmp eax, ecx
jle 0x40cde7
mov dword [esi + 0x14], ecx
jmp 0x40ce0f
mov dword [esi + 0x10], eax
jmp 0x40ce0f
cmp eax, ebx
jle 0x40ce0f
dec eax
push 1
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
push eax
lea ecx, [esi + 8]
call fcn.004d200f
push 1
lea ecx, [esi + 0xc]
push dword [esi + 0x10]
call fcn.004d200f
cmp dword [esi + 0x64], ebx
je 0x40ce1b
mov dword [esi + 0x1c], 6
mov eax, dword [esp + 0x18]
add esi, 0x38
push 1
push esi
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 1
pop eax
pop ebp
pop ebx
jmp 0x40ce37
xor eax, eax
pop edi
pop esi
ret 0xc