joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012559
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
mov byte [eax + esi + 0x1c], 0x80
inc dword [esi + 0x5c]
cmp eax, 0x37
mov eax, dword [esi + 0x5c]
jle 0x100125a6
jmp 0x1001257c
mov byte [eax + esi + 0x1c], 0
inc dword [esi + 0x5c]
mov eax, dword [esi + 0x5c]
cmp eax, 0x40
jl 0x10012571
call fcn.100123c4
jmp 0x10012593
mov eax, dword [esi + 0x5c]
mov byte [esi + eax + 0x1c], 0
inc dword [esi + 0x5c]
cmp dword [esi + 0x5c], 0x38
jl 0x10012588
jmp 0x100125ab
mov byte [eax + esi + 0x1c], 0
inc dword [esi + 0x5c]
mov eax, dword [esi + 0x5c]
cmp eax, 0x38
jl 0x1001259b
mov al, byte [esi + 0x1b]
mov ecx, esi
mov byte [esi + 0x54], al
mov al, byte [esi + 0x1a]
mov byte [esi + 0x55], al
mov al, byte [esi + 0x19]
mov byte [esi + 0x56], al
mov al, byte [esi + 0x18]
mov byte [esi + 0x57], al
mov al, byte [esi + 0x17]
mov byte [esi + 0x58], al
mov al, byte [esi + 0x16]
mov byte [esi + 0x59], al
mov al, byte [esi + 0x15]
mov byte [esi + 0x5a], al
mov al, byte [esi + 0x14]
mov byte [esi + 0x5b], al
pop esi
jmp fcn.100123c4

Function at 0x1001480d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
add edi, 0xdeadbeef
add edi, ecx
push 0xc
pop eax
mov edx, edi
mov esi, edi
mov dword [ebp + 0x10], edx
cmp ecx, eax
jbe 0x10014907
lea eax, [ecx - 0xd]
xor edx, edx
push 0xc
pop ecx
div ecx
inc eax
mov dword [ebp + 8], eax
movzx edx, byte [ebx + 7]
movzx ecx, byte [ebx + 6]
movzx eax, byte [ebx + 5]
shl edx, 8
add edx, ecx
movzx ecx, byte [ebx + 0xb]
shl ecx, 8
shl edx, 8
add edx, eax
movzx eax, byte [ebx + 4]
add esi, eax
shl edx, 8
movzx eax, byte [ebx + 0xa]
add esi, edx
add ecx, eax
movzx edx, byte [ebx + 8]
movzx eax, byte [ebx + 9]
add edx, edi
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [ebx + 3]
shl ecx, 8
mov edi, edx
add ecx, eax
rol edi, 4
movzx eax, byte [ebx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx]
shl ecx, 8
add ecx, eax
sub ecx, edx
add edx, esi
add ecx, dword [ebp + 0x10]
xor edi, ecx
sub esi, edi
mov eax, edi
add edi, edx
rol eax, 6
xor eax, esi
sub edx, eax
mov ecx, eax
rol ecx, 8
add eax, edi
xor ecx, edx
sub edi, ecx
mov edx, ecx
rol edx, 0x10
add ecx, eax
xor edx, edi
mov esi, edx
sub eax, edx
ror esi, 0xd
add edx, ecx
xor esi, eax
mov dword [ebp + 0x10], edx
sub ecx, esi
mov edi, esi
rol edi, 4
add esi, edx
xor edi, ecx
mov ecx, dword [ebp + 0xc]
push 0xc
pop eax
sub ecx, eax
add ebx, eax
sub dword [ebp + 8], 1
mov dword [ebp + 0xc], ecx
jne 0x10014844
cmp ecx, eax
ja 0x10014973
jmp dword [ecx*4 + 0x10013dc1]
xor edi, esi
mov eax, esi
rol eax, 0xe
sub edi, eax
mov eax, edi
mov edx, edi
xor edx, dword [ebp + 0x10]
rol eax, 0xb
sub edx, eax
xor esi, edx
mov eax, edx
ror eax, 7
sub esi, eax
mov eax, esi
xor edi, esi
rol eax, 0x10
sub edi, eax
mov eax, edi
mov ecx, edi
rol eax, 4
xor ecx, edx
sub ecx, eax
mov eax, ecx
xor esi, ecx
rol eax, 0xe
sub esi, eax
mov eax, esi
xor edi, esi
ror eax, 8
sub edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10015dd5
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov dword [edx + 0x9c0], 1
mov ecx, dword [edx + 0x9c0]
mov eax, dword [edx + ecx*4 - 4]
shr eax, 0x1e
xor eax, dword [edx + ecx*4 - 4]
imul eax, eax, 0x6c078965
add eax, ecx
mov dword [edx + ecx*4], eax
inc dword [edx + 0x9c0]
cmp dword [edx + 0x9c0], 0x270
jl 0x10015dea
pop ebp
ret

Function at 0x10015e1a
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push edi
mov edi, dword [edx + 0x9c0]
cmp edi, 0x270
jl 0x10015ecc
push ebx
xor edi, edi
mov ebx, 0x7fffffff
push esi
mov esi, edi
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
and ecx, ebx
xor ecx, dword [edx + esi*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x1001f02c]
xor ecx, dword [edx + esi*4 + 0x634]
mov dword [edx + esi*4], ecx
inc esi
cmp esi, 0xe3
jl 0x10015e3e
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
and ecx, ebx
xor ecx, dword [edx + esi*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x1001f02c]
xor ecx, dword [edx + esi*4 - 0x38c]
mov dword [edx + esi*4], ecx
inc esi
cmp esi, 0x26f
jl 0x10015e6b
mov ecx, dword [edx + 0x9bc]
xor ecx, dword [edx]
and ecx, ebx
xor ecx, dword [edx + 0x9bc]
mov eax, ecx
shr ecx, 1
and eax, 1
pop esi
pop ebx
mov eax, dword [eax*4 + 0x1001f02c]
xor eax, dword [edx + 0x630]
xor eax, ecx
mov dword [edx + 0x9bc], eax
mov dword [edx + 0x9c0], edi
mov ecx, dword [edx + edi*4]
lea eax, [edi + 1]
mov dword [edx + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop edi
pop ebp
ret

Function at 0x10017f50
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10017f60

Function at 0x100181e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10018490
Function at 0x51897c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ba4
xor eax, eax
push ebp
push 0x518a12
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 4]
call fcn.00404bb4
push eax
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov esi, eax
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push esi
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, dword [ebp - 8]
call fcn.004047e4
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00404748
push esi
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518a19
lea eax, [ebp - 0xc]
call fcn.004046f4
lea eax, [ebp - 4]
call fcn.004046f4
ret

Function at 0x518a30
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov dword [ebp - 8], 0x10
mov eax, dword [ebp - 8]
call fcn.00402a54
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x518a8a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x518a74
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004048ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518a91
mov eax, dword [ebp - 4]
call fcn.00402a84
ret

Function at 0x518a98
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.004050c0
lea eax, [ebp - 8]
call fcn.004050c0
lea eax, [ebp + 0x10]
call fcn.004050c0
lea eax, [ebp + 0xc]
call fcn.004050c0
xor eax, eax
push ebp
push 0x518b3e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_Wow64DisableWow64FsRedirection
test eax, eax
je 0x518aff
push esi
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.shell32.dll_ShellExecuteW
jmp 0x518b16
push esi
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518b45
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e18
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00404e18
ret

Function at 0x519840
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.00409c9c
add esp, 0x108
pop ebx
ret
Function at 0x51b174
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov eax, dword [0x525014]
cmp dword [eax], 2
jne 0x51b1ee
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x51b1ee
lea eax, [esp + 0xc]
push eax
push 0x51b204
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov edx, 0x10
xor ecx, ecx
mov dword [esp + 4], ecx
test al, al
je 0x51b1ee
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x28
pop ebx
ret

Function at 0x51b218
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ba4
xor eax, eax
push ebp
push 0x51b399
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.00516390
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.005163b0
mov ebx, eax
jmp 0x51b365
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404964
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409924
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408c14
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408c14
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404b00
je 0x51b33c
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404964
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408c14
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408c14
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404b00
jne 0x51b356
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.005163d0
mov ebx, eax
test ebx, ebx
jne 0x51b297
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b3a0
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404718
lea eax, [ebp - 4]
call fcn.004046f4
ret

Function at 0x51ba80
Capabilities:
Write file on windows

Disassembly:
push ebx
add esp, 0xfffffdfc
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push 0x51bad8
call sub.kernel32.dll_CreateFileA
mov ebx, eax
lea eax, [esp + 4]
mov edx, 0x200
call fcn.004078f0
push 0
lea eax, [esp + 4]
push eax
push 0x200
lea eax, [esp + 0x10]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
add esp, 0x204
pop ebx
ret
Function at 0x51be4c
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x51c027
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x51c038
call sub.kernel32.dll_GetModuleHandleA_2
cmp eax, 1
jbe 0x51be7f
push 0
call sub.kernel32.dll_ExitProcess_1
push 0x51c044
call sub.kernel32.dll_GetModuleHandleA_2
cmp eax, 1
jbe 0x51be95
push 0
call sub.kernel32.dll_ExitProcess_1
mov ecx, 0x56710c
mov edx, 0x567108
mov eax, 0x567104
call fcn.0051b68c
lea eax, [ebp - 4]
mov edx, 0x51c058
call fcn.0040478c
xor esi, esi
mov edi, 8
mov ebx, 0x5246c8
lea eax, [ebp - 0x10]
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
call fcn.00404a00
mov eax, dword [ebp - 0x10]
call fcn.00409720
test al, al
je 0x51bedf
xor eax, eax
mov esi, eax
add ebx, 4
dec edi
jne 0x51bec2
test esi, esi
jne 0x51bf78
mov eax, dword [0x567104]
mov edx, 0x51c07c
call fcn.00404b00
jne 0x51bf78
lea eax, [ebp - 0x14]
call fcn.00518a30
mov eax, dword [ebp - 0x14]
mov edx, 0x51c08c
call fcn.00404b00
jne 0x51bf78
mov eax, dword [0x5670e0]
mov eax, dword [eax + 0x3bc]
mov eax, dword [eax + 0x220]
mov edx, 0x51c09c
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x5670e0]
mov eax, dword [eax + 0x3bc]
mov eax, dword [eax + 0x220]
mov edx, 0x51c148
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 0
push 0
push 1
mov ecx, 0x51c168
mov edx, 0x51c1a4
xor eax, eax
call fcn.00518a98
mov eax, 0x51c148
call fcn.00409850
call fcn.00404578
push 0
call sub.kernel32.dll_ExitProcess_1
lea eax, [ebp - 8]
mov edx, 0x51c1b8
call fcn.0040478c
mov esi, 1
mov edi, 0x13
mov ebx, 0x5246e8
lea eax, [ebp - 0x18]
mov ecx, dword [ebx]
mov edx, dword [ebp - 8]
call fcn.00404a00
mov eax, dword [ebp - 0x18]
call fcn.00409720
test al, al
je 0x51bfb1
xor eax, eax
mov esi, eax
add ebx, 4
dec edi
jne 0x51bf94
test esi, esi
jne 0x51bfc2
push 0
call sub.kernel32.dll_ExitProcess_1
lea eax, [ebp - 0xc]
mov edx, 0x51c1d8
call fcn.0040478c
mov esi, 1
mov edi, 4
mov ebx, 0x524734
mov ecx, dword [ebx]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
call fcn.00404a00
mov eax, dword [ebp - 0x1c]
call fcn.00409720
test al, al
je 0x51bffb
xor eax, eax
mov esi, eax
add ebx, 4
dec edi
jne 0x51bfde
test esi, esi
jne 0x51c00c
push 0
call sub.kernel32.dll_ExitProcess_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c02e
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404718
ret
Function at 0x10002a80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10019ff0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [sym.imp.USER32.dll_DefWindowProcA]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 4], ebx
mov dword [esp + 0xc], esi
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], eax
push 0x10002d40
push 0x10002d00
push 8
lea ecx, [esi + 0x28]
push 0xa8
push ecx
mov dword [esp + 0x30], ebx
mov dword [esi + 0x20], 0x1001b2a0
call fcn.1000df7a
lea edi, [esi + 0x568]
mov byte [esp + 0x1c], 1
mov ecx, edi
call fcn.10003d40
mov dword [edi + 0x2c], ebx
mov dword [edi], 0x1001b294
lea edi, [esi + 0x5c0]
mov byte [esp + 0x1c], 2
mov ecx, edi
call fcn.10003d40
mov dword [edi + 0x2c], ebx
mov dword [edi], 0x1001b294
push fcn.100030f0
push 0x10002d90
push 8
lea edx, [esi + 0x618]
push 0x58
push edx
mov byte [esp + 0x30], 3
call fcn.1000df7a
push fcn.100030f0
push 0x10002d90
push 8
lea eax, [esi + 0x8d8]
push 0x58
push eax
mov byte [esp + 0x30], 4
call fcn.1000df7a
push fcn.10004f20
push 0x10001400
lea edi, [esi + 0xbb8]
push 8
push 0x10
push edi
mov byte [esp + 0x30], 5
mov dword [esp + 0x24], edi
call fcn.1000df7a
push fcn.10004f20
push 0x10001400
push 8
add edi, 0x80
push 0x10
push edi
mov byte [esp + 0x30], 6
call fcn.1000df7a
mov ecx, dword [esp + 0x14]
mov dword [esi], 0x1001b284
mov dword [esi + 0x20], 0x1001b260
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4026e4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
movzx eax, byte [esi + 0x17]
xor ebx, ebx
sub eax, ebx
push edi
je 0x4027f1
dec eax
je 0x402746
dec eax
je 0x402721
dec eax
je 0x40270f
push dword [esi + 0x18]
push dword [ebp + 8]
call dword [esi + 0x10]
jmp 0x40278e
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x4027a9
mov byte [eax], bl
jmp 0x4027a9
mov esi, dword [ebp + 8]
push esi
mov ecx, 0x4681d8
call fcn.0044384e
cmp eax, 0xffffffff
jne 0x402736
xor eax, eax
cmp esi, ebx
je 0x4027fc
mov byte [eax + esi], bl
jmp 0x4027fc
mov ecx, esi
call fcn.00401dcc
cmp dword [0x4673b0], ebx
jne 0x4027ad
cmp dword [esi + 0xc], ebx
jne 0x4027ad
cmp dword [0x46b468], esi
mov edi, dword [ebp + 8]
jne 0x402769
cmp edi, ebx
jne 0x402799
push ebx
lea eax, [ebp - 1]
push eax
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
cmp eax, ebx
je 0x402795
cmp edi, ebx
mov dword [0x46b468], ebx
je 0x402792
push edi
push dword [esi + 0x18]
call fcn.004395a4
pop ecx
pop ecx
jmp 0x4027fc
dec eax
jmp 0x4027fc
cmp edi, ebx
je 0x4027a3
mov byte [edi], bl
mov dword [0x46b468], ebx
jmp 0x4027a9
mov dword [0x46b468], esi
xor eax, eax
jmp 0x4027fc
mov edi, dword [ebp + 8]
cmp edi, ebx
mov eax, dword [esi + 0xc]
je 0x4027fc
cmp eax, ebx
jne 0x4027bf
mov byte [edi], bl
jmp 0x4027a9
mov ecx, dword [esi + 8]
cmp edi, ecx
je 0x4027fc
cmp eax, 0x186a0
jb 0x4027e7
push eax
push ecx
push edi
call fcn.004576b0
mov eax, dword [esi + 0xc]
add esp, 0xc
mov byte [edi + eax], bl
mov eax, dword [esi + 0xc]
jmp 0x4027fc
mov byte [edi], al
inc edi
inc ecx
mov al, byte [ecx]
cmp al, bl
jne 0x4027e3
mov byte [edi], bl
jmp 0x4027de
push dword [ebp + 8]
mov ecx, dword [esi + 0xc]
call fcn.004026e4
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40dc06
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp byte [ebp + 0x10], bl
push esi
mov eax, 0xd0
je 0x40dc23
inc dword [0x4673b8]
add dword [0x465108], eax
push eax
push 0x467038
push dword [0x465108]
call fcn.004576b0
mov esi, dword [0x465108]
mov eax, dword [ebp + 8]
add esp, 0xc
cmp byte [ebp + 0x10], bl
mov dword [esi + 0x2c], eax
je 0x40dc53
push ebx
mov ecx, 0x467ce0
call fcn.0040d84f
cmp dword [0x4673d8], ebx
mov dword [0x468198], ebx
mov dword [0x46819c], ebx
je 0x40dc72
push 0x467b80
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
cmp byte [ebp + 0xc], bl
jne 0x40dce8
or ecx, 0xffffffff
cmp byte [esi + 0xc6], bl
jne 0x40dc9b
cmp byte [ebp + 0x14], 0x64
sete al
cmp al, bl
mov byte [esi + 0xc6], al
je 0x40dc9b
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4681a4], ebx
je 0x40dcab
cmp dword [0x4681a0], ebx
jne 0x40dcb3
cmp byte [esi + 0xc6], bl
je 0x40dce8
cmp byte [esi + 0xc6], bl
mov byte [esi + 0xc4], bl
jne 0x40dce8
cmp dword [0x4681a4], ebx
jge 0x40dcd1
mov dword [esi + 0xb8], ecx
jmp 0x40dce8
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esi + 0xb4], eax
mov eax, dword [0x4681a4]
mov dword [esi + 0xb8], eax
pop esi
pop ebx
pop ebp
ret
Function at 0x411b37
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
xor ebx, ebx
cmp byte [0x4693f4], bl
mov dword [ebp - 8], ecx
jne 0x411c9b
cmp dword [0x46841c], ebx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
jne 0x411b68
call edi
mov dword [0x46841c], eax
inc dword [0x4693f0]
push esi
call edi
mov ecx, dword [0x4693f0]
mov esi, dword [0x465084]
mov edx, eax
sub edx, dword [0x46841c]
cmp ecx, dword [0x465080]
mov dword [0x468420], eax
jbe 0x411c08
cmp edx, esi
jae 0x411c08
push edx
push ecx
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
xor esi, esi
lea eax, [ebp - 0x80c]
push 0x800
inc esi
push eax
mov dword [ebp - 0xc], esi
call fcn.0040a6d3
add esp, 0x14
call fcn.0041192c
fldz
push ebx
push ecx
push ecx
fstp qword [esp]
push ebx
lea eax, [ebp - 0x80c]
push 4
push eax
mov byte [0x4693f4], 1
mov dword [0x46506c], ebx
call fcn.0043c205
add esp, 0x18
cmp eax, 7
jne 0x411bf5
push ebx
push ebx
push esi
mov ecx, 0x467ce0
call fcn.00417d99
mov eax, dword [0x468420]
mov dword [0x46506c], esi
mov byte [0x4693f4], bl
jmp 0x411c0f
cmp edx, esi
mov dword [ebp - 0xc], ebx
jbe 0x411c1f
cmp dword [ebp - 0xc], ebx
mov dword [0x4693f0], ebx
mov dword [0x46841c], eax
jne 0x411c99
mov ecx, dword [ebp - 8]
mov al, byte [ecx + 0x11]
mov byte [0x468171], al
cmp byte [ecx + 0x1a], bl
je 0x411c67
cmp byte [ecx + 0x1b], bl
je 0x411c67
mov byte [ebp - 1], 1
call fcn.004113c1
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
inc byte [esi + 0x19]
call fcn.004065a4
dec byte [esi + 0x19]
cmp byte [ebp - 1], bl
mov dword [ebp + 8], eax
je 0x411c5d
mov ecx, dword [ebp - 8]
call fcn.004118c0
cmp dword [ebp + 8], ebx
jne 0x411c6c
mov byte [esi + 0x1d], bl
jmp 0x411c99
mov byte [ebp - 1], bl
jmp 0x411c3d
cmp byte [esi + 0x1d], bl
je 0x411c99
mov byte [esi + 0x1d], bl
call edi
sub eax, dword [esi + 4]
cmp eax, 0x3e8
ja 0x411c99
mov eax, dword [ebp - 8]
movzx eax, word [eax]
push ebx
push eax
push 0x312
push dword [0x467254]
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x4120fe
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [esp + 4], 0xa
jne 0x412108
mov al, 0xd
ret
push ebx
push dword [esp + 0x10]
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_VkKeyScanExA]
mov ebx, eax
shr ebx, 8
cmp bl, 0xff
jne 0x412129
cmp al, 0xff
jne 0x412129
xor al, al
pop ebx
ret
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x41217c
mov dl, bl
and dl, 6
cmp dl, 6
jne 0x412149
cmp byte [0x4683a2], 0
je 0x412149
or byte [ecx], 8
jmp 0x41216b
test bl, 2
je 0x41215a
mov dl, byte [ecx]
test dl, 3
jne 0x41215a
or dl, 1
mov byte [ecx], dl
test bl, 4
je 0x41216b
mov dl, byte [ecx]
test dl, 0xc
jne 0x41216b
or dl, 4
mov byte [ecx], dl
test bl, 1
je 0x41217c
mov dl, byte [ecx]
test dl, 0x30
jne 0x41217c
or dl, 0x10
mov byte [ecx], dl
pop ebx
ret
Function at 0x415646
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
xor ebx, ebx
cmp byte [ebp + 8], bl
lea eax, [ebp - 0x10]
jge 0x41565e
mov byte [ebp - 0x10], 0x30
lea eax, [ebp - 0xf]
push 0xa
push eax
movzx eax, byte [ebp + 8]
push eax
call fcn.0040125c
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, ebx
jle 0x415702
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp + 8], eax
cmp dword [0x469480], ebx
jne 0x4156d5
call esi
sub eax, dword [0x4681ac]
mov ecx, dword [0x465108]
cmp eax, dword [ecx + 0xb0]
jbe 0x4156d5
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4156ce
push 1
push 0xffffffffffffffff
mov dword [0x46506c], ebx
call fcn.0040de6e
pop ecx
pop ecx
mov dword [0x46506c], 1
call esi
mov dword [0x4681ac], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00414070
cmp dword [0x469480], 2
mov eax, dword [0x465108]
pop ecx
jne 0x4156f2
mov eax, dword [eax + 0x60]
jmp 0x4156f5
mov eax, dword [eax + 0x5c]
push eax
call fcn.004123cc
dec dword [ebp + 8]
pop ecx
jne 0x415683
pop esi
pop ebx
leave
ret

Function at 0x415c53
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ecx
movzx eax, byte [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push eax
call ebp
mov ecx, dword [esp + 0x18]
and al, 1
neg al
sbb eax, eax
xor edi, edi
inc eax
inc eax
inc edi
cmp ecx, edi
mov dword [esp + 0xc], eax
je 0x415c85
cmp ecx, 2
jne 0x415d50
cmp eax, ecx
je 0x415d50
push ebx
xor ebx, ebx
cmp byte [esp + 0x18], 0x90
push esi
mov esi, 0xffc3d44d
jne 0x415cc1
cmp byte [0x468399], bl
je 0x415caf
call fcn.00415d55
jmp 0x415d4a
push esi
push ebx
push ebx
push ebx
push 0x90
push edi
call fcn.00412cfd
add esp, 0x18
push esi
push ebx
push ebx
push ebx
push dword [esp + 0x2c]
push 2
call fcn.00412cfd
add esp, 0x18
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x467c9c]
sete byte [esp + 0x13]
cmp byte [esp + 0x13], bl
je 0x415d08
push edi
push 0xffffffffffffffff
mov dword [0x46506c], ebx
call fcn.0040de6e
pop ecx
pop ecx
mov dword [0x46506c], edi
cmp byte [esp + 0x1c], 0x14
jne 0x415d4a
cmp dword [esp + 0x20], 2
jne 0x415d4a
push 0x14
call ebp
test al, 1
je 0x415d4a
push esi
push ebx
push ebx
push ebx
push 0x10
push 2
call fcn.00412cfd
add esp, 0x18
cmp byte [esp + 0x13], bl
je 0x415d4a
push edi
push 0xffffffffffffffff
mov dword [0x46506c], ebx
call fcn.0040de6e
pop ecx
pop ecx
mov dword [0x46506c], edi
mov eax, dword [esp + 0x14]
pop esi
pop ebx
pop edi
pop ebp
pop ecx
pop ecx
ret