joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7913f6
Capabilities:
Authenticate hmac

Disassembly:
not edx
jmp 0x7111f4
xor edx, 0xcaac891f
and byte [esp + eax*2 - 0x2c2af56b], ch
call fcn.0075bbb6
mov edx, 0xc0b29819
mov cx, word [ebp]
mov ax, word [ebp + 2]
rol edx, 0x46
lea ebp, [ebp + edx*2 - 0x594c0cde]
shl dl, 0xc4
add cx, ax
mov eax, edx
ror eax, 0x29
mov word [edx + ebp - 0x2ca60600], cx
ror edx, 1
mov ecx, dword [esp + eax*4 - 0x5855eae4]
jmp 0x70c041
mov edx, dword [eax + edi - 0x16157abb]
lea edi, [edi + eax*4 - 0x5855eae8]
xor edx, ebx
mov dword [esp + eax - 0x16157abb], 0x5c8a06ba
bswap edx
neg eax
jl 0x79b475
push eax
rol edx, 1
bswap edx
neg eax
not edx
sbb word [esp + eax*4 - 0x5855eae6], 0xb189
lea edx, [edx + eax + 0x408e3fe9]
shl word [esp + eax*2 - 0x2c2af571], 0x4d
ror dword [esp + eax*4 - 0x5855eae8], 0x39
not edx
push eax
bswap edx
jp 0x74b86f
inc ecx
mov edx, 0x1bb6618b
inc di
mov edi, dword [esi + edx*4 - 0x6ed9862c]
dec edx
lea edx, [edx*2 + 0x7a95f937]
sal dx, 0xc9
inc ecx
mov esp, 0x4b38e326
dec edi
lea esi, [esi + edx - 0x1bb66189]
inc ecx
push esp
inc edx
movzx ebx, word [esi + edx - 0x1bb6618b]
dec edx
lea esi, [esi + edx*4 - 0x6ed9862a]
dec edx
sbb dword [esp + edx - 0x1bb6618b], 0x1339b394
inc esp
movsx ebx, dx
push edx
xor bx, bp
dec edi
lea ebx, [esp + edx + 0x39360539]
not bx
dec edx
lea edi, [edx + ebx*2 + 0x4d29cdbe]
dec bx
neg bx
not bx
inc ebp
movsx ecx, ah
inc ecx
movsx ecx, bx
add bx, 0x2c2b
dec edx
inc dword [esp + edx - 0x1bb6618a]
inc edx
dec byte [esp + edx*4 - 0x6ed98628]
inc edx
sub byte [esp + edx*2 - 0x376cc310], 6
xor bp, bx
dec esp
xchg edi, ebx
dec eax
lea ebx, [esp + ebx + 0x10]
inc esi
mov byte [ebx + edx - 0x1bb6618b], bh
inc edx
mov ebx, dword [esi + edx - 0x1bb6618b]
dec ecx
sal edx, 0xea
inc dx
sal dword [esp + ecx - 0x20], cl
dec ecx
lea esi, [ecx + esi - 0x22]
inc edx
ror byte [esp - 0x4b38e31a], 0x26
xor ebx, ebp
mov eax, 0x7e3776b6
inc esp
movzx ebp, bh
inc edx
and dword [esp + ecx - 0x23], 0x591a63b2
inc ebx
shl dx, 0x8a
inc ecx
sal ebp, 0xbf
inc dx
or dword [esp + ecx*4 - 0x98], ecx
bswap ebx
xor ebx, 0xf9adeb17
dec ecx
sar edx, cl
neg ebx
inc dx
sal dword [esp + edx*4 + 0x2679d8], 0x81
dec edx
mov dword [esp + edx + 0x99e7d], ebp
dec edx
or dword [esp + edx + 0x99e75], eax
inc cx
or edx, ebx
inc edx
xor dword [esp + edx*2 + 0x133cf2], ebx
inc si
add dword [esp + edx + 0x99e76], ebp
jg 0x7efe38
mov eax, 0xe00b7a1e
or ax, 0x4812
mov eax, dword [ebp]
mov edx, 0xdc0f9f14
mov ecx, 0xf899bc31
add cx, 0xee0b
mov edx, dword [ebp + 4]
dec cl
jbe 0x751edb
dec edx
mov ebp, dword [esp + edx*2 + 0x133cf2]
inc ecx
push esp
inc edx
xchg byte [esp + edx*2 + 0x133cf3], bh
dec eax
arpl bx, bx
dec edx
mov dword [esp + edx + 0x99e85], 0xaa9abfaf
inc edx
add byte [esp + edx + 0x99e8c], 0x13
dec esp
add eax, ebx
inc ecx
not ch
inc edx
sal byte [esp + edx + 0x99e7d], 0xa4
dec ecx
bswap esp
dec esi
mov dword [esp + edx + 0x99e75], eax
ret 0x10
Function at 0x793a0c
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [edi]
call fcn.0072436e
add byte [eax], al
add byte [ebp + 0x6e], al
je 0x793a7f
jb 0x793a5f
jb 0x793a87
je 0x793a89
arpl word [ecx + 0x6c], sp
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add cl, dl
rol ecx, 0xc8
enter 0xffffffffffffe281, 6
jecxz 0x793a65
xor byte [ecx + eax*4], al
add al, 0x81
fnstcw word [esi + ebp*2]
cwde
loop 0x793a34
fld st(1)
call 0x340b8a68
fld dword [ebx]
int1
mov dword [esp + eax - 0xc106], esi
ret
xchg esi, eax
mov edx, dword [edi]
jmp 0x7c5632
add eax, dword [eax]
and eax, 0x81178b00
mov dword [eax + eax], 0x4c8b0000
and al, 4
lea ecx, [eax*8 + 0x483993bc]
add edi, 4
sal ecx, 0x4b
ror ecx, 0xbf
sbb al, ch
xor edx, ebx
inc ecx
inc edx
neg edx
call fcn.007a3c87
mov edx, 0x92040637
movzx eax, dx
rol eax, 0x3f
mov ecx, dword [edi]
sub edx, eax
lea edi, [edx + edi - 0x12040318]
xor ecx, ebx
sub eax, edx
call fcn.007f4afb

Function at 0x7ba40b
Capabilities:
Parse pe header

Disassembly:
je 0x6f5b90
mov esi, dword [ebp + 0xc]
jmp 0x7cfa54
je 0x6f5b90
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x6f5b8a
push ebp
movzx ebp, cx
ror bp, 0x14
mov ebp, esp
btr dx, 0x3e
mov edx, dword [ebp + 8]
test esp, ecx
cmp di, 0xa1a5
jmp 0x815135
test esi, esi
jmp 0x77e7fd
lea esp, [esp - 0x114]
test sp, bp
push esi
test ebx, eax
stc
test edx, edx
jmp 0x76fa38

Function at 0x7c68f8
Capabilities:
Execute syscall

Disassembly:
dec esi
mov ebx, dword [esp + esi*4 - 0x174]
dec esi
mov esi, dword [esp + esi - 0x49]
call fcn.00811ed0
dec eax
mov dword [esp], 0xd0073705
dec esp
mov edx, dword [esp + 8]
inc esp
movsx esi, bl
jmp 0x6fff27

Function at 0x7d9cad
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor dx, 0x4f01
jbe 0x7d9cae
mov dword [esp + 0x10], 0x81829450
mov edx, dword [esp + edx + 0x7fef80ec]
mov ebp, 0x73a8320b
call fcn.007a0149
daa
iretd
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5a087759
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x63ad1343
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x402fc4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x46a008], 0x8088405
inc edx
mov dword [ebx + 0x46a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4036d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46a024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403768
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403748
xor eax, eax
push ebp
push 0x403741
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403784
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403748
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x46a024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46a024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404608
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47d04c], 0
je 0x404669
cmp word [0x47d220], 0xd7b2
jne 0x404631
cmp dword [0x47d228], 0
jbe 0x404631
mov eax, 0x47d21c
call dword [0x47d238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46a75c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404690
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46a030], 0
jne 0x404685
push 0
push 0x46a754
push 0x46a75c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405ee8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40600c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405e5f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40600c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405e5f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406028
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405ee8
xor eax, eax
push ebp
push 0x405ee1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405c18
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405ec6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406048
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405ec6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ee8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406002
cmp byte [ebp - 0xd], 0
jne 0x405f2f
cmp byte [ebp - 0x12], 0
je 0x406002
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405f48
dec ebx
cmp byte [ebx], 0x2e
je 0x405f57
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405f47
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406002
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405f94
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406002
cmp byte [ebp - 0xd], 0
je 0x406002
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406002
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408488
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x408518
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x408518
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x4084cb
test edx, 3
jne 0x4084ba
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x4084c5
jmp 0x4084cb
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x4084cb
cmp dword [ecx - 8], 1
je 0x4084d5
mov edx, ebx
or edx, 3
call fcn.00404ed4
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x4084e7
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404788

Function at 0x408524
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4085b4
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4085b4
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408567
test edx, 3
jne 0x408556
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408561
jmp 0x408567
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408567
cmp dword [ecx - 8], 1
je 0x408571
mov edx, ebx
or edx, 3
call fcn.00404ed4
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x408583
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404788

Function at 0x408de0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404c4c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408df9
test al, 0x10
je 0x408dfd
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x408e04
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404c4c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408e1d
test al, 0x10
jne 0x408e21
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40b8c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b8fd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404878
jmp 0x40b906
mov eax, ebx
mov edx, esi
call fcn.004047dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b910
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b932
movzx eax, byte [esp]
jmp 0x40b934
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bfc4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40be3c
mov eax, dword [0x47c694]
cmp byte [eax], 0
je 0x40c040
mov eax, dword [0x47c4ac]
call fcn.00403098
call fcn.00402e08
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408fe8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c088
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c076
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x47c454]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x47f7f8]
call fcn.00405bc0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40c91c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c9f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404820
lea eax, [ebp - 4]
call fcn.00404c9c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404c4c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c9dc
mov eax, ebx
call fcn.00402cac
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c9d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404c4c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c9bf
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40ca04
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c9bf
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c9dc
mov eax, dword [ebp - 0x10]
call fcn.00402cc8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c9f9
lea eax, [ebp - 4]
call fcn.00404788
ret
Function at 0x41e97c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x480308
cmp dword [edi], 0
jne 0x41e9f8
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x480304]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x46aaf4
mov ecx, 2
call fcn.00402e9c
mov edx, 0x41e954
lea eax, [esi + 5]
call fcn.0041e974
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041e974
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41e9cd
mov dword [0x480304], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41fd40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c3c
mov eax, dword [ebp - 8]
call fcn.00404c3c
xor eax, eax
push ebp
push 0x41fe2b
push dword fs:[eax]
mov dword fs:[eax], esp
nop
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404c4c
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov eax, dword [ebp - 4]
call fcn.00404c4c
push eax
call sub.kernel32.dll_GetModuleHandleA_1
mov dword [0x480358], eax
mov eax, dword [ebp - 8]
call fcn.00404c4c
push eax
mov eax, dword [0x480358]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48035c], eax
mov eax, dword [0x480360]
push eax
push 0x40
push 0x17d783fc
push 0x48035c
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.C:WindowsSystem32_ntdll.dll_NtProtectVirtualMemory
mov edx, 0x48035c
mov eax, sub.kernel32.dll_GetCPInfo
mov ecx, 4
call fcn.0041fd34
push 0x480360
push 4
push sub.kernel32.dll_GetCPInfo
push 0x48035c
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.C:WindowsSystem32_ntdll.dll_NtWriteVirtualMemory
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.C:WindowsSystem32_ntdll.dll_NtFlushInstructionCache
mov eax, dword [0x480358]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41fe32
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047ac
ret
Function at 0x4205c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404c4c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x420620
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x47c7b8]
mov dl, 1
mov eax, dword [0x4200ec]
call fcn.0040c184
call fcn.0040412c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004201f4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42147c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x421482
ret
Function at 0x42ef50
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404788
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x42ef9e
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004049f8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433020
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x433153
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x42014c]
call fcn.0042021c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x433129
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004202bc
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.004049f8
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x433168
call fcn.00404a98
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00420320
lea ecx, [ebp - 4]
mov edx, 0x4331a4
mov eax, dword [ebp - 0xc]
call fcn.00420550
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040dc04
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x43310c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4331b0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x46b408]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433113
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x433200
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x433247
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43322a
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43323b
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x433247
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret