joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a33b0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x100a33bb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.100a33d0
Function at 0x100b35f0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10138008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x100b36ea
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x100b36e3
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x100b36c9
call ebx
cmp dword [ebp - 0x14], eax
jne 0x100b36c9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x100b36c9
mov edx, dword [esi]
test edx, edx
jne 0x100b3692
push 0x200
push edx
push dword [0x1013dddc]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x100b36e3
jmp 0x100b36bd
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x100b36bd
shl eax, 3
push eax
push edx
push 0
push dword [0x1013dddc]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x100b36e3
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100b3651
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x100b372f
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x100b372f
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100b3729
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.100b3480
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x100b36f6
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100bcc77
mov esp, ebp
pop ebp
ret

Function at 0x100b3740
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx]
test eax, eax
je 0x100b378e
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x100b377e
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x100b3775
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x100b3752
mov eax, dword [ebx]
pop edi
push eax
push 0
push dword [0x1013dddc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x100b3790
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x1013ec70]
mov al, byte [esi + 0x14]
mov edi, dword [esi]
and al, 1
je 0x100b37ac
sub edi, 5
movzx eax, al
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100b37d4
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x100b37ef
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100b3820
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x1013ec78]
push ebx
push esi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x100b38fd
mov eax, dword [0x1013ec70]
add eax, 0x14
test byte [eax], 2
je 0x100b385a
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x100b3845
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x100b38fd
push edi
push 1
or edx, 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.100b35f0
mov ecx, dword [0x1013ec78]
add esp, 4
cmp esi, ecx
jae 0x100b38ab
imul edi, esi, 0x2c
mov eax, dword [0x1013ec70]
test byte [edi + eax + 0x14], 2
jne 0x100b38a0
mov ecx, esi
call fcn.100b3790
mov ebx, eax
test ebx, ebx
jne 0x100b38a8
mov ecx, dword [0x1013ec78]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x100b3881
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100b38fc
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x100b38ed
mov ebx, eax
jmp 0x100b38c0
push dword [ebx + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x100b38e1
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x100b38c0
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x1013dddc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b7130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
nop dword [eax]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x1013e498], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x1013e198], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x1013e398], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x1013e298], al
inc esi
cmp esi, 0x100
jl 0x100b7240
pop esi
add esp, 0x80
ret

Function at 0x100d00bb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100cfd7b

Function at 0x1536000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x153600a
jmp 0x153800f
jmp fcn.0122e058
Function at 0x401a5c
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401b12
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x45c5cc
call sub.KERNEL32.DLL_WaitForSingleObject
cmp byte [0x45c04d], 0
je 0x401a8a
push 0x45c5cc
call sub.KERNEL32.DLL_WinExec
mov eax, 0x45c5ec
call fcn.00401420
mov eax, 0x45c5fc
call fcn.00401420
mov eax, 0x45c628
call fcn.00401420
push 0xff8
push 0
call sub.KERNEL32.DLL_Sleep
mov dword [0x45c624], eax
cmp dword [0x45c624], 0
je 0x401af1
mov eax, 3
mov edx, dword [0x45c624]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401ac7
mov eax, 0x45c60c
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x45c618], eax
mov byte [0x45c5c4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401b19
cmp byte [0x45c04d], 0
je 0x401b11
push 0x45c5cc
call sub.KERNEL32.DLL_WriteFile
ret

Function at 0x401b20
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x45c5c4], 0
je 0x401bfd
xor edx, edx
push ebp
push 0x401bf6
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x45c04d], 0
je 0x401b52
push 0x45c5cc
call sub.KERNEL32.DLL_WinExec
mov byte [0x45c5c4], 0
mov eax, dword [0x45c624]
push eax
call sub.KERNEL32.DLL_TerminateProcess
xor eax, eax
mov dword [0x45c624], eax
mov ebx, dword [0x45c5ec]
jmp 0x401b85
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_VirtualQuery
mov ebx, dword [ebx]
cmp ebx, 0x45c5ec
jne 0x401b73
mov eax, 0x45c5ec
call fcn.00401420
mov eax, 0x45c5fc
call fcn.00401420
mov eax, 0x45c628
call fcn.00401420
mov eax, dword [0x45c5e4]
test eax, eax
je 0x401bcb
mov edx, dword [eax]
mov dword [0x45c5e4], edx
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov eax, dword [0x45c5e4]
test eax, eax
jne 0x401bb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401bfd
cmp byte [0x45c04d], 0
je 0x401beb
push 0x45c5cc
call sub.KERNEL32.DLL_WriteFile
push 0x45c5cc
call sub.KERNEL32.DLL_lstrcpyA
ret
pop ebx
pop ebp
ret
Function at 0x402148
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x45c5c4], 0
jne 0x402165
call fcn.00401a5c
test al, al
je 0x40216d
cmp ebx, 0x7ffffff8
jle 0x402177
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4022cb
xor ecx, ecx
push ebp
push 0x4022c4
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x45c04d], 0
je 0x402198
push 0x45c5cc
call sub.KERNEL32.DLL_WinExec
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x4021a8
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x402247
mov eax, ebx
test eax, eax
jns 0x4021bd
add eax, 3
sar eax, 2
mov edx, dword [0x45c624]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x402247
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x4021f8
mov eax, ebx
test eax, eax
jns 0x4021e7
add eax, 3
sar eax, 2
mov ecx, dword [0x45c624]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x40221e
mov ecx, ebx
test ecx, ecx
jns 0x402201
add ecx, 3
sar ecx, 2
mov edi, dword [0x45c624]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x45c5b4]
sub ebx, 4
add dword [0x45c5b8], ebx
call fcn.00403984
jmp 0x4022cb
cmp ebx, dword [0x45c61c]
jg 0x402299
sub dword [0x45c61c], ebx
cmp dword [0x45c61c], 0xc
jge 0x40226b
add ebx, dword [0x45c61c]
xor eax, eax
mov dword [0x45c61c], eax
mov eax, dword [0x45c620]
add dword [0x45c620], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x45c5b4]
sub ebx, 4
add dword [0x45c5b8], ebx
call fcn.00403984
jmp 0x4022cb
mov eax, ebx
call fcn.00402054
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4022cb
cmp byte [0x45c04d], 0
je 0x4022c3
push 0x45c5cc
call sub.KERNEL32.DLL_WriteFile
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4022d8
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x45c5c8], eax
cmp byte [0x45c5c4], 0
jne 0x402310
call fcn.00401a5c
test al, al
jne 0x402310
mov dword [0x45c5c8], 8
mov dword [ebp - 4], 8
jmp 0x402471
xor ecx, ecx
push ebp
push 0x40246a
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x45c04d], 0
je 0x402331
push 0x45c5cc
call sub.KERNEL32.DLL_WinExec
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x40234c
mov dword [0x45c5c8], 9
jmp 0x402441
dec dword [0x45c5b4]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x45c5b8], eax
test bl, 1
je 0x4023ac
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x40237c
test edx, 0x80000003
je 0x40238b
mov dword [0x45c5c8], 0xa
jmp 0x402441
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4023a3
mov dword [0x45c5c8], 0xa
jmp 0x402441
add ebx, edx
mov esi, eax
call fcn.00401c00
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x45c620]
jne 0x4023ec
sub dword [0x45c620], ebx
add dword [0x45c61c], ebx
cmp dword [0x45c61c], 0x3c00
jle 0x4023dd
call fcn.00401ef0
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403984
jmp 0x402471
mov edx, dword [eax]
test dl, 2
je 0x40240f
and edx, 0x7ffffffc
cmp edx, 4
jge 0x40240a
mov dword [0x45c5c8], 0xb
jmp 0x402441
or dword [eax], 1
jmp 0x402438
mov eax, edi
cmp dword [eax + 4], 0
je 0x402422
cmp dword [eax], 0
je 0x402422
cmp dword [eax + 8], 0xc
jge 0x40242e
mov dword [0x45c5c8], 0xb
jmp 0x402441
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401c00
mov edx, ebx
mov eax, esi
call fcn.00401e68
mov eax, dword [0x45c5c8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402471
cmp byte [0x45c04d], 0
je 0x402469
push 0x45c5cc
call sub.KERNEL32.DLL_WriteFile
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x404554
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
je 0x404568
push eax
push 0
call sub.user32.dll_ShowWindow
test eax, eax
je 0x40454c
ret
Function at 0x4051f8
Capabilities:
Extract resource via kernel32 functions
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x40538c
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
test esi, esi
je 0x405260
push 0x40539c
push esi
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
je 0x405260
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x405260
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_OpenProcess
jmp 0x405382
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x4052a0
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x405382
mov eax, dword [ebp - 4]
add eax, 2
call fcn.004051e4
mov esi, eax
cmp byte [esi], 0
je 0x405382
lea eax, [esi + 1]
call fcn.004051e4
mov esi, eax
cmp byte [esi], 0
je 0x405382
jmp 0x4052a6
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_OpenProcess
jmp 0x405365
lea eax, [esi + 1]
call fcn.004051e4
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x405382
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_OpenProcess
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GlobalReAlloc
mov esi, eax
cmp esi, 0xffffffff
je 0x405382
push esi
call sub.KERNEL32.DLL_GlobalHandle
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_ReadFile
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x405382
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_OpenProcess
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_ReadFile
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x4052c4
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_OpenProcess
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4053b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_LeaveCriticalSection
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4055e0
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x405433
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4055e0
push 0x80000002
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x405433
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4055fc
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
jne 0x4054bc
xor eax, eax
push ebp
push 0x4054b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004051f8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x40549a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40561c
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x40549a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4054bc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_TranslateMessage
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_OpenProcess
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_MulDiv
push eax
call sub.KERNEL32.DLL_InitializeCriticalSection
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4055d6
cmp byte [ebp - 0xd], 0
jne 0x405503
cmp byte [ebp - 0x12], 0
je 0x4055d6
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ReadFile
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40551c
dec ebx
cmp byte [ebx], 0x2e
je 0x40552b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40551b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4055d6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405568
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_OpenProcess
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_MultiByteToWideChar
mov esi, eax
test esi, esi
jne 0x4055d6
cmp byte [ebp - 0xd], 0
je 0x4055d6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_OpenProcess
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_MultiByteToWideChar
mov esi, eax
test esi, esi
jne 0x4055d6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_OpenProcess
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_MultiByteToWideChar
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bdfc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bed2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403f34
lea eax, [ebp - 8]
call fcn.004043ac
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040435c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40bebc
mov eax, ebx
call fcn.0040271c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40beb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040435c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40be9f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40bee4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40be9f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bebc
mov eax, dword [ebp - 0x10]
call fcn.0040273c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bed9
lea eax, [ebp - 8]
call fcn.00403e9c
ret

Function at 0x41f0b8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41f0be
ret

Function at 0x420810
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov dl, byte [0x420890]
mov eax, ebx
call fcn.00420d00
mov dl, byte [0x420894]
mov eax, dword [ebp - 4]
call fcn.00420d00
mov edx, dword [ebx + 0x20]
push edx
mov edx, dword [edi + 0xc]
sub edx, dword [edi + 4]
push edx
mov edx, dword [edi + 8]
sub edx, dword [edi]
push edx
mov edx, dword [edi + 4]
push edx
mov edx, dword [edi]
push edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
push edx
mov edx, dword [esi + 0xc]
sub edx, dword [esi + 4]
push edx
mov edx, dword [esi + 8]
mov eax, dword [esi]
sub edx, eax
push edx
mov edx, dword [esi + 4]
push edx
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyboardLayoutList
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x420df8
Capabilities:
Log keystrokes via polling
Read clipboard data

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
call fcn.004205d4
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx + 0x14]
call fcn.004205d4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetClassInfoA
mov eax, dword [ebx + 0x14]
call fcn.004206b4
test al, al
jne 0x420e4b
mov eax, dword [ebx + 0x14]
call fcn.00420598
call fcn.0041f914
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetClientRect
push 2
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetClipboardData
pop ebx
ret
mov eax, dword [ebx + 0x14]
call fcn.00420598
call fcn.0041f914
not eax
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetClientRect
push 1
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetClipboardData
pop ebx
ret