joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415daa
Capabilities:
Encode data using xor

Disassembly:
pushfd
xor bl, byte [edx]
sal byte [0x1b9d8c60], 0x86
pop esi
arpl word [eax], si
add edx, dword [esi + 0x25a3268]
adc ah, bl
ret

Function at 0x415ec2
Capabilities:
Encode data using xor

Disassembly:
mov dword [0x104561d6], eax
and al, 0x25
add al, 6
iretd
push es
or al, bl
or ebx, dword [esi - 0x1b]
aas
cmp esp, dword [edi + 0x38e88715]
mov esp, 0x74771911
mov edx, 0xab7ddd4
cwde
ret
cmp dword [ebp - 0x61], 0xe61134d3
mov ch, 0x71
mov ch, 0xb1
push ebp
sal dword [ecx + edx], cl
out 0xb5, al
jno 0x415eac
mov cl, 0x55
cmpsd dword [esi], dword es:[edi]
bnd js 0x415f27
leave
jecxz 0x415ea1
scasd eax, dword es:[edi]
xchg ecx, eax
cmp byte [eax + eax - 0x4f], ah
mov ecx, 0xf542c9bb
xchg edi, eax
adc byte [ebx - 0x1c1892e8], dl
stosb byte es:[edi], al
inc esp
mov eax, dword [0x373ae694]
add edx, dword [0x408249dd]
or dword [ebx - 0x450c30fa], ecx
xor bl, byte [ebx]
sbb al, 0x5a
out dx, al
and al, 0xb7
push ss
inc edx
sbb cl, ah
sti
cmp edx, dword [ecx]
push ebp
fcom qword [ecx]
mov ecx, 0xefc1a404
int1
mov ebp, 0xa1eebcdd
enter 0xffffffffffffb987, 0xffffffffffffffdc
sbb al, 0x2d
int 0xe6
mov es, word [edi]
and eax, 0x1a7c3d0c
test byte [ebx - 0x4b316b1b], ah
out dx, eax
push es
push ebx
out 0xe0, eax
pop ebx
inc ecx
jne 0x415ef0
mov ss, word [eax + eax*8 + 0x5b888cef]
sbb bh, bl
mov ebp, 0x58e83d29
mul byte [ecx]
lodsd eax, dword [esi]
nop
mov dword [eax - 0x73e87929], esi
invalid

Function at 0x416031
Capabilities:
Encode data using xor

Disassembly:
cmp esp, eax
cdq
sti
mov ah, 0xc2
sub eax, 0x5f2a45dd
mov cl, dh
out dx, al
pop esi
out dx, eax
xchg dword [ebp - 0x3c], edi
fcmovnb st(0), st(4)
adc ah, byte [ebx - 0x24a5f37d]
arpl si, sp
or dword [0x1885bdc6], ebx

Function at 0x416d7d
Capabilities:
Encode data using xor

Disassembly:
pop ebp
xor eax, 0xaf2b8111
movsd dword es:[edi], dword [esi]
add al, 0x78
and al, 0xa9
and eax, 0xd6b921de
mov bh, 0x74
add dword [ebp + 0x25], edx
mov dl, dl
js 0x416d53
outsd dx, dword [esi]
xchg ecx, ebx
test eax, 0xe3700d10
in eax, dx
sbb dword [ebp + 0x79], edi
xchg esi, eax
adc al, 0xee
xor ebx, dword [edi]
jb 0x416d6c
xchg edx, eax
das
dec esp
inc eax
fdivr qword [ecx + 7]
and bl, byte [esp + edx*8 + 0x7f]
sbb dword [ecx + eax*2 - 0x77], edi
or byte [edx + 0x2464f616], cl
jl 0x416db1
push ebx
cwde
retf
Function at 0x43eb07
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
xor ecx, ecx
lea ebx, [ebp]
mov word [ebx + 0x200], 0
add ebx, 2
mov word [ebx + 0x200], 0
add ebx, 2
mov word [ebx + 0x200], 0
add ebx, 2
mov word [ebx + 0x200], 0
add ebx, 2
add ecx, 8
cmp ecx, 0x100
jl 0x43eb0c
xor ecx, ecx
and ecx, 0xff
mov ebx, ecx
add ebx, ebp
mov byte [ebx], cl
inc cx
cmp cx, 0x100
jl 0x43eb49
xor ecx, ecx
xor edx, edx
and edx, 0xff
mov ebx, edx
add ebx, ebp
add dl, byte [ebx + 0x200]
and ecx, 0xff
mov ebx, ecx
add ebx, ebp
add dl, byte [ebx]
and ecx, 0xff
mov ebx, ecx
add ebx, ebp
mov al, byte [ebx]
and edx, 0xff
mov ebx, edx
add ebx, ebp
mov ah, byte [ebx]
and ecx, 0xff
mov ebx, ecx
add ebx, ebp
mov byte [ebx], ah
and edx, 0xff
mov ebx, edx
add ebx, ebp
mov byte [ebx], al
inc cx
cmp cx, 0x100
jl 0x43eb62
xor edi, edi
add cl, 1
and ecx, 0xff
mov ebx, ecx
add ebx, ebp
add dl, byte [ebx]
mov al, byte [ebx]
and edx, 0xff
mov ebx, edx
add ebx, ebp
mov ah, byte [ebx]
and ecx, 0xff
mov ebx, ecx
add ebx, ebp
mov byte [ebx], ah
and edx, 0xff
mov ebx, edx
add ebx, ebp
mov byte [ebx], al
and ecx, 0xff
mov ebx, ecx
add ebx, ebp
mov al, byte [ebx]
and edx, 0xff
mov ebx, edx
add ebx, ebp
add al, byte [ebx]
and eax, 0xff
mov ebx, eax
add ebx, ebp
mov ch, byte [ebx]
xor ch, byte [esi + edi]
mov byte [esi + edi], ch
inc edi
cmp edi, dword [ebp + 0x108]
jne 0x43ebb9
ret
Function at 0x40baf8
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov ebx, edx
dec ebx
test ebx, ebx
jl 0x40bb3e
inc ebx
xor esi, esi
test esi, esi
je 0x40bb15
push 0xfa
call sub.kernel32.dll_Sleep
mov eax, edi
call fcn.004033a0
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x40bb3e
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x40bb3e
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x40bb3e
inc esi
dec ebx
jne 0x40bb07
pop edi
pop esi
pop ebx
ret

Function at 0x40bca4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea ebx, [ebp - 0x74]
xor eax, eax
push ebp
push 0x40bd96
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x78]
mov eax, esi
call fcn.0040b2d8
push dword [ebp - 0x78]
push 0x40bdac
push edi
lea eax, [ebp - 4]
mov edx, 3
call fcn.004032ac
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402738
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033a0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x40bd2f
mov al, 0x5d
call fcn.0040bb44
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x40bd46
push ebx
call sub.user32.dll_TranslateMessage
push ebx
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push ebx
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x40bd3a
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x40bd46
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bd9d
lea eax, [ebp - 0x78]
call fcn.00403120
lea eax, [ebp - 4]
call fcn.00403120
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x1da202f8
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x6deb0f1f
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x403338
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x470020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033d0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033b0
xor eax, eax
push ebp
push 0x4033a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033ec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033b0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x470020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x470020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040cc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x472048], 0
je 0x40412d
cmp word [0x47221c], 0xd7b2
jne 0x4040f5
cmp dword [0x472224], 0
jbe 0x4040f5
mov eax, 0x472218
call dword [0x472234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47006c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404154
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x470030], 0
jne 0x404149
push 0
push 0x470064
push 0x47006c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405ed0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405f36
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004044c0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402efc
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405f20
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f3d
lea eax, [ebp - 0x10]
call fcn.00404250
ret

Function at 0x40b388
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b3c1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404340
jmp 0x40b3ca
mov eax, ebx
mov edx, esi
call fcn.004042a4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b3d4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b3f5
mov al, byte [esp]
jmp 0x40b3f7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ba8c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b8f4
mov eax, dword [0x471a78]
cmp byte [eax], 0
je 0x40bb08
mov eax, dword [0x471888]
call fcn.00402d68
call fcn.00402bc4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004088f4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bb50
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bb3e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x471834]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x472664]
call fcn.0040533c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c3ac
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c482
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004042e8
lea eax, [ebp - 8]
call fcn.00404760
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404710
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c46c
mov eax, ebx
call fcn.00402a38
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c465
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404710
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c44f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c494
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c44f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c46c
mov eax, dword [ebp - 0x10]
call fcn.00402a68
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c489
lea eax, [ebp - 8]
call fcn.00404250
ret

Function at 0x40c9f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40ca54
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044c0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408428
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ca5b
lea eax, [ebp - 0xc]
call fcn.00404250
ret

Function at 0x41ad30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x472884
cmp dword [edi], 0
jne 0x41adac
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x472880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4703ec
mov ecx, 2
call fcn.00402c58
mov edx, 0x41ad08
lea eax, [esi + 5]
call fcn.0041ad28
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041ad28
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41ad81
mov dword [0x472880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41c338
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41c33e
ret
Function at 0x41e930
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41e981
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41e968
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41e958
jmp 0x41e981
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41e969
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42793c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404700
xor eax, eax
push ebp
push 0x427a6a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x427a3d
xor eax, eax
push ebp
push 0x427a36
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404510
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x427a0b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x4279fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404510
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404710
mov edx, ebx
pop ecx
call fcn.00402c58
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427a01
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x4717dc]
mov dl, 1
mov eax, dword [0x40725c]
call fcn.0040bc10
call fcn.00403c64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427a71
lea eax, [ebp - 4]
call fcn.00404250
ret
Function at 0x427a78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x427c29
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404900
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x427c40
call fcn.0040455c
mov eax, ebx
call fcn.0041a2c4
mov edi, eax
dec edi
test edi, edi
jl 0x427b30
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041a298
mov edx, dword [0x42f75c]
call fcn.0040365c
test al, al
je 0x427b2c
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041a298
lea edx, [ebp - 0x14]
call fcn.00439140
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404900
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045d0
inc esi
dec edi
jne 0x427ade
mov al, byte [0x427c44]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x427c50
mov eax, dword [ebp - 0xc]
call fcn.0040cfcc
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004042e8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00439140
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x427c40
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00439140
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x427c40
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x427c40
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x427c5c
call fcn.00409000
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427c30
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404274
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404274
lea eax, [ebp - 0x14]
call fcn.00404250
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404274
ret
Function at 0x42c548
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0043fc2c
test al, al
je 0x42c5a3
cmp bl, 7
jne 0x42c57f
push 2
lea eax, [esp + 4]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
movzx edi, byte [esp]
sub edi, 0x30
jmp 0x42c584
mov edi, ebx
and edi, 0x7f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xd0]
test eax, eax
je 0x42c5a3
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xd0]
mov edx, edi
call fcn.00424928
mov byte [esi + 0x220], bl
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x433688
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x4335d4
call sub.user32.dll_EnumWindows
ret

Function at 0x4337a8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x433825
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00433208
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x4337cd
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00432e08
cmp dword [ebp - 4], 0
je 0x43380f
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404710
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43382c
lea eax, [ebp - 4]
call fcn.00404250
ret
Function at 0x436c90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x472b88], 0
je 0x436ddf
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x471a14]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x436ddf
mov eax, dword [0x472b8c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x472b88]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x436dae
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x472b88]
call fcn.00414300
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x436da6
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x436da6
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x436da6
mov eax, dword [ebp - 0x14]
call fcn.0043f928
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x436da6
push ebp
call fcn.00436c4c
pop ecx
test al, al
jne 0x436da6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x436d62
mov eax, dword [ebp - 0x14]
call fcn.0043e458
dec eax
jle 0x436da6
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004036cc
cmp byte [ebp - 1], 0
je 0x436da6
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x436da6
mov edx, dword [ebp - 0x14]
mov eax, dword [0x472b8c]
call fcn.00436418
inc edi
dec ebx
jne 0x436cf5
mov eax, dword [0x472b8c]
cmp dword [eax + 8], 0
jle 0x436dc6
mov eax, dword [0x472b8c]
call fcn.004364a8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x436ddf
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00436ab4
pop ecx
test al, al
jne 0x436ddf
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret