joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cf8c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45cfc4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45cfa5
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45cfb4
or bl, 4
test esi, 0x20000000
je 0x45cfbf
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45d014
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.0045cfc8
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret

Function at 0x4635e8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4635fa
add esp, 0xfffffff0
call fcn.00403a98
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041fe64
mov eax, dword [0x4c7cc8]
mov dword [eax + 4], ebx
mov dword [eax], 0x46398c
mov eax, dword [0x4c7cdc]
mov dword [eax + 4], ebx
mov dword [eax], 0x463998
mov eax, ebx
call fcn.004639a4
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x415598]
call fcn.00403704
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x415598]
call fcn.00403704
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x415598]
call fcn.00403704
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x415598]
call fcn.00403704
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x415598]
call fcn.00403704
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45fe6c
push eax
push 0
push 0
mov eax, dword [0x4c7e68]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x421944]
call fcn.004230b8
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x421944]
call fcn.004230b8
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x421944]
call fcn.004230b8
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00463e0c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x463ce8
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x463ce8
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x463ce8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x463737
call fcn.00403af0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x463acc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x463c77
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x463c58
mov dl, 1
mov eax, dword [0x415c50]
call fcn.00403704
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004044a0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x463c47
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00450fa8
test al, al
je 0x463c3a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x463c88
lea eax, [ebp - 0x254]
call fcn.0040986c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x463c3a
xor eax, eax
push ebp
push 0x463c33
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x463cc0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x463c1c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404708
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x463c1c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404708
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463c3a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x463b3d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041a464
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463c7e
lea eax, [ebp - 0x260]
call fcn.004044a0
ret

Function at 0x4645ac
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4c9c34]
cmp byte [eax + 0xa5], 0
jne 0x46461d
cmp dword [0x4c9c4c], 0
jne 0x4645de
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x464568
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4c9c4c], eax
cmp dword [0x4c9c48], 0
jne 0x4645f9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4c9c48], eax
cmp dword [0x4c9c50], 0
jne 0x46461d
push esp
push 0
push 0
push 0x46450c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4c9c50], eax
pop edx
ret
Function at 0x464740
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x464757
add esp, 0xfffffff0
call fcn.00403a98
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041fe64
mov eax, dword [0x4c7e58]
cmp word [eax + 2], 0
jne 0x46477f
mov eax, dword [0x4c7e58]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00465e1c
mov eax, dword [0x4c7f18]
cmp word [eax + 2], 0
jne 0x464799
mov eax, dword [0x4c7f18]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00466014
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x415598]
call fcn.00403704
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x415598]
call fcn.00403704
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x42241c]
call fcn.00429d84
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x464920
mov eax, dword [0x4c7d48]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042a154
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x466584
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4c7d48]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040cfbc
test eax, eax
je 0x46488e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004091b4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cfe4
test eax, eax
je 0x4648a2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404708
mov eax, dword [0x4c7bc0]
cmp byte [eax], 0
jne 0x4648d6
mov eax, ebx
call fcn.00464a48
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00466760
mov eax, ebx
call fcn.004670a0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x464916
call fcn.00403af0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464cbc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4c9c34]
cmp dword [eax + 0x30], 0
je 0x464d66
cmp dword [ebx + 0x94], 0
jne 0x464d60
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x464c4c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x464d60
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x464d26
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x464d60
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417e1c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x464d35
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x465844
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x465879
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404590
jmp 0x465886
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004044f4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46693c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46697d
mov eax, esi
call fcn.0044c690
test al, al
je 0x46697d
mov eax, dword [ebx + 0x84]
call fcn.0044c38c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46697d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044c38c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x46a014
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x46a042
mov eax, ebx
call fcn.0046aacc
cmp dword [ebx + 0x3c], 0
je 0x46a03b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x46a0b3
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x46a0a5
cmp dword [ebx + 8], 0
je 0x46a064
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x46a076
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46a0a5
cmp dword [ebx + 8], 0
je 0x46a057
cmp eax, 3
je 0x46a089
dec eax
jne 0x46a057
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46a057
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x46a057
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x46a0d1
cmp dword [ebx + 0x10], 0xcc
je 0x46a0d1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046a0dc
pop ebx
ret
Function at 0x47d740
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404950
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x47d798
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4c80d4]
mov dl, 1
mov eax, dword [0x47d264]
call fcn.0040c3d4
call fcn.00403f00
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0047d36c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x47d830
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xffffff54
cmp byte [0x4c778c], 0
jne 0x47d902
mov byte [0x4c778c], 1
xor eax, eax
mov dword [0x4c7778], eax
mov dword [esp + 0x18], 0x94
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x1c], 3
ja 0x47d878
cmp dword [esp + 0x1c], 3
jne 0x47d8d8
cmp dword [esp + 0x20], 0x33
jbe 0x47d8d8
mov dword [esp + 4], 9
push esp
push 0x20019
push 0
push 0x47d90c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x47d902
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x47d93c
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x47d902
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [esp + 8], 0x31
jne 0x47d902
cmp byte [esp + 9], 0
jne 0x47d902
jmp 0x47d8ed
push 0
push 0x47d93c
push 0x47d944
call sub.kernel32.dll_GetProfileIntA
test eax, eax
je 0x47d902
mov eax, dword [0x4c7774]
call fcn.00404950
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4c7778], eax
add esp, 0xac
ret

Function at 0x48b214
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0044c690
test al, al
je 0x48b26f
cmp bl, 7
jne 0x48b24b
push 2
lea eax, [esp + 4]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
movzx edi, byte [esp]
sub edi, 0x30
jmp 0x48b250
mov edi, ebx
and edi, 0x7f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
je 0x48b26f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, edi
call fcn.0042b1b0
mov byte [esi + 0x220], bl
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4a784c
Capabilities:
Create mailslot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff98
call fcn.004a728c
push edi
push ebp
push esi
call sub.user32.dll_SetClassLongA
push ebx
call sub.gdi32.dll_GetTextCharacterExtra
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push eax
call sub.mpr.dll_WNetGetProviderNameW
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_GetBinaryTypeA
lea ecx, [esp + 0x48]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
call fcn.0042adfc
mov al, byte [esp + 0x1c]
push eax
call sub.user32.dll_IsCharAlphaA
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push eax
call sub.user32.dll_CharLowerBuffW
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push eax
call sub.user32.dll_GetClassLongW
mov eax, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push eax
call sub.kernel32.dll_CreateMailslotA
mov eax, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push eax
call sub.gdi32.dll_SetMapMode
add esp, 0x68
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a7b2c
Capabilities:
Connect to http server
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeec
mov dword [esp], edx
mov ebx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push ebx
push ecx
push esi
push ebp
push edi
push edx
push eax
call sub.wininet.dll_InternetConnectW
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_FindFirstChangeNotificationW
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
call sub.kernel32.dll_FoldStringW
mov eax, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
push eax
call sub.advapi32.dll_SetKernelObjectSecurity
mov eax, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x4c]
push eax
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
call fcn.0047d9b4
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
call sub.user32.dll_CharUpperBuffA
mov eax, dword [esp + 0x5c]
push eax
mov eax, dword [esp + 0x5c]
push eax
mov ax, word [esp + 0x5c]
push eax
call sub.kernel32.dll_GlobalGetAtomNameW
mov eax, dword [esp + 0x64]
push eax
mov eax, dword [esp + 0x64]
push eax
call sub.kernel32.dll_EndUpdateResourceA
mov eax, dword [esp + 0x70]
push eax
mov eax, dword [esp + 0x70]
push eax
mov eax, dword [esp + 0x70]
push eax
call sub.user32.dll_RealGetWindowClassA
mov eax, dword [esp + 0x88]
push eax
mov eax, dword [esp + 0x88]
push eax
mov eax, dword [esp + 0x88]
push eax
mov eax, dword [esp + 0x88]
push eax
mov eax, dword [esp + 0x88]
push eax
mov eax, dword [esp + 0x88]
push eax
call sub.kernel32.dll_GetDateFormatA
mov eax, dword [esp + 0x90]
push eax
mov eax, dword [esp + 0x90]
push eax
call sub.gdi32.dll_SetBkColor
mov edx, dword [esp + 0x98]
mov eax, dword [esp + 0x94]
call fcn.0042b208
mov eax, dword [esp + 0xa4]
push eax
mov eax, dword [esp + 0xa4]
push eax
mov eax, dword [esp + 0xa4]
push eax
call sub.kernel32.dll_GetPrivateProfileSectionNamesW
lea edx, [esp + 0xec]
mov eax, dword [esp + 0xa8]
call fcn.0042b108
mov eax, dword [esp + 0xac]
push eax
call sub.user32.dll_RegisterClipboardFormatW
mov eax, dword [esp + 0xbc]
push eax
mov eax, dword [esp + 0xc4]
push eax
mov eax, dword [esp + 0xcc]
push eax
mov ecx, dword [esp + 0xc4]
mov edx, dword [esp + 0xc0]
mov eax, dword [esp + 0xbc]
call fcn.0047d94c
mov eax, dword [esp + 0xc8]
push eax
call sub.comctl32.dll_ImageList_Destroy
lea eax, [esp + 0xe0]
push eax
push dword [esp + 0xe0]
mov eax, dword [esp + 0xe0]
push eax
lea eax, [esp + 0xdc]
push eax
mov eax, dword [esp + 0xdc]
push eax
call sub.kernel32.dll_ScrollConsoleScreenBufferA
mov eax, dword [esp + 0xe8]
push eax
mov eax, dword [esp + 0xe8]
push eax
call sub.wininet.dll_FtpDeleteFileA
add esp, 0x114
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4028e1
Capabilities:
Encode data using xor

Disassembly:
inc ecx
pop esi
xor byte [esi + ecx + 7], cl
loop 0x4028e4
ljmp 0x2ab6:0xda8d5821

Function at 0x405d47
Capabilities:
Accept command line arguments

Disassembly:
jne 0xfe405df6
sub byte [0xf0410384], al
aam 0x7e
add byte [eax], al
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x405db3
adc ebx, dword [esi]
add eax, dword [ecx]
test eax, eax
jne 0x405d89
push eax
push 0xa2f40c
push 0xffffffffffffffbf
call fcn.0040a940
add esp, 0xc
mov dword [0x413d43], eax
test eax, eax
je 0x405e3a
xchg ebp, eax
dec ebp
cld
push ecx
push esi
call eax
mov esi, eax
test esi, esi
je 0x405db3
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
push edx
push esi
push eax
call fcn.0040a5d0
mov ecx, dword [ebp + 8]
sbb esp, 0xc
mov dword ds:[ecx], eax
call dword [0x41c058]
push ebx
call dword [0x3d2cc054]
mov ebx, eax
push 0xffffffffffffffff
push ebx
push dword [esi + sym.imp.MSVCRT.dll___p__environ]
push eax
call 0x405e50
mov edi, dword [ebp - 0x46]
add esp, 0xc
test edi, edi
add byte [edi], bl
mov dh, byte [eax*4 + 0x53]
int 0xff
adc eax, 0x4140c146
add esp, 4
mov dword [edi], eax
call dword [sym.imp.MSVCRT.dll___p__environ]
xor dword [ebx], eax
mov ecx, esi
mov esi, dword [eax]
mov ecx, dword [ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
adc ecx, edx
and ecx, 0x19
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esp, dword [ebp - 0x11bf3ed8]
call dword [ebx + ecx*4 + 8]
pop ebx
test ecx, ecx
je 0x405e2e
call 0xff78ea1b
salc
push edi
mov dword [eax], 0x9e
call dword [0xe8c7c144]
add esp, 4
xor eax, eax
stc
push 0xffffffffffffff8b
in eax, 0x5d
xchg edi, eax
or al, 0
push 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
adc dword [edi + edi*8 - 0xb], ecx
or byte [eax - 0x6f6f6f70], dl
not dword [eax + 0x3b90c990]
push ebp
mov edi, ebp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
cmp bl, byte [ebp + 0x10]
push esi
test ebx, ebx
sbb eax, 0x1bbac7d
add byte [esi - 0x4f], al
and eax, 0x75003883
and dword [esi - 0x7d], esp
js 0x405e72
add byte [esi + eax + 0x43], dh
push es
inc ebx
add eax, 2
jmp 0x405e03
Function at 0x4073db
Capabilities:
Encode data using xor

Disassembly:
jmp 0x40739a
cli
invalid
or eax, 0xfe8e0000
sbb bl, ch
xor al, 0x83
clc
add dword [eax + edx - 0x7d], esi
mov ch, 2
jne 0x40738c
add ebx, 4
xor eax, eax
add ax, word [ebx - 4]
jmp 0x4073fd
lea ecx, [ebp - 0x7d]
lea edx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x30]
push edx
push ecx
push 1
daa
mov dword [ebp - 0x28], eax
call int.004080f0
add esp, 0x14
mov esi, dword [esi - 0x75]
inc ebp
in al, 0x85
ror byte [edi], 0x84
das
add eax, dword [eax]
add byte [ebx + 0x508df045], cl
cmp edx, 0x3b0200
movsb byte es:[edi], byte [esi]
add eax, 0x1ffb8
add byte [ecx], bh
mov ebx, 0x9f8391fc
add eax, dword [eax]
add byte [esi - 0x3a], cl
push es
push esp
dec esi
mov byte [esi], 0x54
mov ecx, dword [ebp - 4]
inc ecx
or eax, 0xfc4ded30
jb 0x407440
aas
mov eax, dword [ebx]
add eax, dword [eax]
sal byte [ebp + 0xa], 0x8b
jmp 0x4074ad
xchg ebp, eax
aaa
add dword fs:[ebx + 0x875021e], eax
movsx esi, word [ebp - 0x7d]
ret
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40747b
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
cli
add byte [edx], al
add byte [eax], al
jb 0x4074c7
mov eax, 0x8c00015d
cmp dword [ebp - 4], eax
jae 0x4074db
dec esi
aam 0xf0
xor byte [ebx + 0x3b419c4d], cl
enter 0x4deb, 0xfffffffffffffffc
jb 0x4074cc
out 0x45, al
rol byte [ebp - 0x27bf040], 1
add ebp, edi
xchg esi, eax
inc ebp
imul cl
xor byte [edx], al
add al, dl
xchg eax, eax
jne 0x407512
mov edx, dword [ebx + 4]
mov ebx, dword [ecx - 0x73]
jne 0x4074f7
pop ecx
lea esi, [ebp - 4]
add ebx, 8
ror byte [ebp + 0x5156ac75], 0x6a
adc byte [edx + 0x50], dl
call fcn.004085e0
add esp, 0x32
jmp 0x407540
cmp eax, 1
retf
mov esi, eax
push ecx
inc ebp
std
test eax, eax
hlt

Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
or esi, 0x10
dec edi
jl 0x407f03
mov esp, 0x8bf7ef45
add byte [eax], al
fld qword [ebp + 8]
fcomp qword [0x1340c2f1]
mov esp, dword [ebx]
adc dword [ebx - 0x75], 0x5d
push esi
xor esi, esi
push edi
fnstsw ax
invalid

Function at 0x40a362
Capabilities:
Terminate process

Disassembly:
push esp
lea eax, [ebx - 0xaef33f]
adc eax, sym.imp.KERNEL32.dll_LeaveCriticalSection
jne 0x40a370
and dword [ecx + 8], eax
call dword fs:[sym.imp.KERNEL32.dll_SetEvent]
jmp 0x40a34c
or ebp, 2
jne 0x40a3d1
pop ebx
dec ecx
or byte [0xc03415f9], ch
inc eax
add dl, bh
sal byte [ebp - 0x2b], 0x8b
xor eax, 0xfcc0d1
call esi
test eax, eax
xchg esp, eax
leave
call esi
add eax, 0xafce9
pop esi
pop ebp
ret 4
nop
nop
xor eax, eax
ret 4
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
test eax, eax
je 0x40a410
mov ecx, dword [ebp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40a40a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x40a3fe
pop esi
jne 0x40a3be
push ss
add bh, bh
salc
call esi
add eax, 0x9a0afc80
pop esi
rol edx, cl
or byte [eax], al
xor edx, dword [eax]
pop ebp
ret 8
mov eax, 0xc04e8d
pop ebp
ret 8
Function at 0x40a550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
pop ebx
inc ebp
or byte [ebp + 0x1cb456c9], al
out dx, eax
je 0x40a569
invalid
mov byte [0x88c9290a], al
or byte [ecx + ecx], bl
inc eax
inc edx
cmp eax, esi
jb 0x40a569
mov byte [eax], 0
rcr byte [ebp - 0x61], 1
or al, 0
nop
push ebp
mov esi, dword [edx]
or dword [ebx + 0x40c1001d], 0
push esi
push edi
mov edi, dword [ebp + 8]
push 0x2f
push edi
call ebx
push 0x5c
push edi
popfd
invalid

Function at 0x403d1d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403d5c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403d5c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403d5c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403d5c
cmp dword [ecx + 0x74], 0xe
jbe 0x403d5c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret