joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56ad74
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56af1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x56af00
mov dl, 1
mov eax, dword [0x43e3bc]
call fcn.0044c124
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
add eax, 0x40
call fcn.00408da4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x56aeef
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004a2dd8
test al, al
je 0x56aee2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x56af30
lea eax, [ebp - 0x394]
call fcn.00423ba0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x56aee2
xor eax, eax
push ebp
push 0x56aedb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x56afa0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x56aec4
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00409cc8
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x44]
jne 0x56aec4
mov eax, dword [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00409cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56aee2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x56ade5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.0044c060
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56af26
lea eax, [ebp - 0x3a0]
call fcn.00408da4
ret

Function at 0x56bad8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x7ad3ec]
cmp byte [eax + 0xb1], 0
jne 0x56bb4a
cmp dword [0x7ad40c], 0
jne 0x56bb0a
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x79bb60]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x7ad40c], eax
cmp dword [0x7ad408], 0
jne 0x56bb25
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x7ad408], eax
cmp dword [0x7ad410], 0
jne 0x56bb4a
push esp
push 0
push 0
mov eax, dword [0x79bb5c]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x7ad410], eax
pop edx
ret
Function at 0x56be3c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x56be53
add esp, 0xfffffff0
call fcn.00407728
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00453a7c
mov eax, dword [0x7a61cc]
cmp byte [eax], 0
jne 0x56be80
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x184], al
mov eax, dword [0x7a6954]
cmp word [eax + 2], 0
jne 0x56be9a
mov eax, dword [0x7a6954]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0056dfe4
mov eax, dword [0x7a6c08]
cmp word [eax + 2], 0
jne 0x56beb4
mov eax, dword [0x7a6c08]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0056e1e8
mov byte [ebx + 0x39], 0
mov dl, 1
mov eax, dword [0x46d7b4]
call fcn.004736b8
mov esi, eax
mov dword [ebx + 0x40], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x56e664
mov dl, 1
mov eax, dword [0x43ac68]
call fcn.00407174
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x43ac68]
call fcn.00407174
mov dword [ebx + 0xb4], eax
xor eax, eax
mov dword [ebx + 0x64], eax
xor eax, eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x60], 0xff000018
mov dword [ebx + 0x7c], 0x1f4
mov byte [ebx + 0x80], 1
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x78], 0x9c4
mov byte [ebx + 0x8c], 0
mov byte [ebx + 0xa9], 1
mov byte [ebx + 0xc0], 1
mov dl, 1
mov eax, dword [0x471f8c]
call fcn.0047cbe0
mov esi, eax
mov dword [ebx + 0xa4], esi
push 0x56c098
mov eax, dword [0x7a6674]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0047cfdc
mov eax, dword [ebx + 0xa4]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x56e924
mov dl, 1
mov eax, dword [0x43ac68]
call fcn.00407174
mov dword [ebx + 0x9c], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x7a6674]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00423988
test eax, eax
je 0x56bfc8
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0042370c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0042396c
test eax, eax
je 0x56bfe0
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x90]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00409cc8
push ebx
push 0x56d9d4
call fcn.00561e28
mov dword [ebx + 0x180], eax
mov byte [ebx + 0xd4], 0
mov eax, dword [0x7a61cc]
cmp byte [eax], 0
jne 0x56c031
mov eax, ebx
call fcn.0056c258
mov byte [ebx + 0x5d], 1
mov byte [ebx + 0x5e], 1
mov byte [ebx + 0x5f], 1
mov byte [ebx + 0xaa], 1
mov byte [ebx + 0xd5], 0
mov byte [ebx + 0xe0], 0
xor eax, eax
mov dword [ebx + 0xd8], eax
mov byte [ebx + 0xd7], 0
xor eax, eax
mov dword [ebx + 0xac], eax
mov eax, ebx
call fcn.0056eb6c
mov eax, ebx
call fcn.0056f798
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x56c08e
call fcn.00407780
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56c590
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x56c63c
cmp dword [ebx + 0x98], 0
jne 0x56c636
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x56c4c8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x56c636
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x56c5fc
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x56c636
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.00447f1c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x56c60b
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x56c85c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x7ad3ec]
cmp dword [eax + 0x178], 0
je 0x56c9c1
test bl, bl
jne 0x56c90f
cmp dword [esi + 0xa0], 0
jne 0x56c904
mov eax, esi
call fcn.0056f5e8
push eax
push 0x56c768
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x56c8d5
mov eax, dword [0x7ad3ec]
cmp byte [eax + 0xd7], 0
je 0x56c8d5
mov eax, dword [esi + 0xdc]
call fcn.0040ae80
mov edi, eax
cmp edi, 0
jl 0x56c8d5
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x56c8be
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x56c904
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00447f1c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x56c8e4
inc dword [esi + 0xa0]
jmp 0x56c9c1
cmp dword [esi + 0xa0], 0
jle 0x56c9c1
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x56c9c1
cmp dword [esi + 0x48], 0
je 0x56c96c
mov eax, dword [0x7ad3ec]
cmp byte [eax + 0xd7], 0
je 0x56c96c
mov eax, dword [esi + 0xdc]
call fcn.0040ae80
mov edi, eax
cmp edi, 0
jl 0x56c96c
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x56c955
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x56c99b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00447f1c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x56c97b
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x55e698]
call fcn.0040b02c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x56d5e0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb0], 0
je 0x56d64b
cmp byte [ebx + 0xd7], 0
jne 0x56d64b
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00408f2c
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x56d638
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x56d658
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.00409184
jmp 0x56d658
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.00409184
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x56ed54
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x56edc2
mov eax, esi
call fcn.0049ce10
test al, al
je 0x56edc2
mov eax, dword [ebx + 0x88]
call fcn.0049ca5c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x56edc2
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x108]
test al, al
je 0x56edb6
push 0
mov eax, dword [ebx + 0x88]
call fcn.0049ca5c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x88]
call fcn.00493b24
jmp 0x56edc2
mov cl, 1
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.0056eb8c
pop esi
pop ebx
ret
Function at 0x57f820
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x57f927
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_GetKeyboardLayout
and eax, 0xffff
mov dword [ebp - 0x20], eax
push 0
push 0
push 0x1004
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.00409da0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00409c0c
push eax
push 0x1004
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_GetLocaleInfoW
call sub.kernel32.dll_GetACP
mov edx, eax
mov eax, dword [ebp - 0x10]
call fcn.00422508
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00409930
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.004092b4
push eax
mov eax, dword [ebp - 0x14]
call fcn.00409834
push eax
push 5
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_MultiByteToWideChar
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
call fcn.00409b5c
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004099f4
push eax
mov eax, dword [ebp - 0x14]
call fcn.004092b4
push eax
mov eax, dword [ebp - 0x14]
call fcn.00409834
push eax
push 5
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_MultiByteToWideChar
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57f92e
lea eax, [ebp - 0x14]
call fcn.00408dc8
lea eax, [ebp - 0x10]
call fcn.00408da4
ret

Function at 0x580478
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x3f
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00409da0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409c0c
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x5804b9
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
call fcn.00409da0
jmp 0x5804c6
mov edx, dword [ebp - 4]
mov eax, dword [0x7a659c]
call fcn.0040cd2c
pop ecx
pop ecx
pop ebp
ret
Function at 0x588740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004092b4
mov edx, eax
mov eax, dword [ebp - 0xc]
xor ecx, ecx
call fcn.004098b8
mov eax, dword [ebp - 4]
call fcn.004092b4
test eax, eax
jle 0x5887c1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0xc]
call fcn.00409378
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
mov cl, byte [ecx + ebx - 1]
mov ebx, dword [ebp - 8]
shr ebx, 8
xor cl, bl
mov byte [eax + edx - 1], cl
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
movzx eax, byte [eax + edx - 1]
add eax, dword [ebp - 8]
imul eax, eax, 0xce6d
add eax, 0x58bf
mov dword [ebp - 8], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x58877a
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x588840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004092b4
mov edx, eax
mov eax, dword [ebp - 0xc]
xor ecx, ecx
call fcn.004098b8
mov eax, dword [ebp - 4]
call fcn.004092b4
test eax, eax
jle 0x5888bf
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0xc]
call fcn.00409378
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
mov cl, byte [ecx + ebx - 1]
mov ebx, dword [ebp - 8]
shr ebx, 8
xor cl, bl
mov byte [eax + edx - 1], cl
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
movzx eax, byte [eax + edx - 1]
add eax, dword [ebp - 8]
imul eax, eax, 0xce6d
add eax, 0x58bf
mov dword [ebp - 8], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x58887a
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5901d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00409da0
push 0x104
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409c0c
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00409da0
pop ecx
pop ecx
pop ebp
ret

Function at 0x590210
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00409da0
push 0x104
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409c0c
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00409da0
pop ecx
pop ecx
pop ebp
ret
Function at 0x590fd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x591170
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004091cc
mov edx, dword [ebp - 0xc]
mov eax, 0x59118c
call fcn.0040a194
test eax, eax
jne 0x591084
mov ecx, 0x59119c
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00588f5c
test al, al
je 0x59103c
cmp byte [ebp - 5], 0
jne 0x591084
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, 0x5911b0
call fcn.00409e78
jmp 0x591084
mov ecx, 0x5911cc
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00588f5c
test al, al
je 0x591064
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, 0x5911e0
call fcn.00409e78
jmp 0x591084
mov edx, dword [ebp - 0xc]
mov eax, 0x5911fc
call fcn.0040a194
dec eax
jle 0x591084
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, 0x59120c
call fcn.00409e78
mov eax, dword [0x7a6a74]
cmp byte [eax], 0
je 0x5910ee
lea eax, [ebp - 0x48]
mov edx, 0x3c
call fcn.00411264
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x140
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, 0x59121c
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc]
call fcn.00409c0c
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 6], al
cmp byte [ebp - 6], 0
je 0x59115a
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x59115a
lea eax, [ebp - 0x84]
mov edx, 0x3c
call fcn.00411264
mov dword [ebp - 0x84], 0x3c
mov dword [ebp - 0x80], 0x140
xor eax, eax
mov dword [ebp - 0x7c], eax
mov eax, 0x591234
call fcn.0059006c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0xc]
call fcn.0059006c
mov dword [ebp - 0x74], eax
xor eax, eax
mov dword [ebp - 0x70], eax
xor eax, eax
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x84]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 6], al
cmp byte [ebp - 6], 0
je 0x59115a
mov eax, dword [ebp - 0x4c]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x591177
lea eax, [ebp - 0xc]
call fcn.00408da4
ret

Function at 0x5a5294
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and eax, 1
test al, al
je 0x5a52c3
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x5a52c6
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x5a52aa
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x7ae5c8], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x5a529f
mov byte [0x7ae9c8], 1
mov esp, ebp
pop ebp
ret
Function at 0x5a52f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp byte [0x7ae9c8], 0
jne 0x5a5317
call fcn.005a5294
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x5a5356
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x14]
and eax, 0xff
mov eax, dword [eax*4 + 0x7ae5c8]
mov edx, dword [ebp - 0x14]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x5a532a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x5cceb4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0059006c
push eax
push 0
mov eax, dword [0x7a6b6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x178]
push eax
call sub.shell32.dll_ShellExecuteW
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret
Function at 0x61f1c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x61f3bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x28]
mov eax, dword [esi + 0x31e]
call fcn.00493c08
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x10]
call fcn.00406db8
fstp dword [ebp - 0xc]
wait
mov eax, esi
call fcn.0061ed64
test al, al
je 0x61f265
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x61f265
fld dword [esi + 0x2b0]
fmul dword [0x61f3cc]
fadd dword [ebp - 0xc]
fstp dword [ebp - 0xc]
wait
fld dword [esi + 0x2b0]
fmul dword [0x61f3cc]
fdivr dword [ebp - 0xc]
call fcn.00404d4c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
fild qword [ebp - 0x30]
fld dword [esi + 0x2b0]
fmul dword [0x61f3cc]
fmulp st(1)
fstp dword [ebp - 0xc]
wait
jmp 0x61f272
fld dword [ebp - 0xc]
fadd dword [esi + 0x2b0]
fstp dword [ebp - 0xc]
wait
fld dword [ebp - 0xc]
fcomp dword [esi + 0x2a8]
wait
fnstsw ax
sahf
jae 0x61f28a
mov eax, dword [esi + 0x2a8]
mov dword [ebp - 0xc], eax
fld dword [ebp - 0xc]
fcomp dword [esi + 0x2ac]
wait
fnstsw ax
sahf
jbe 0x61f2a2
mov eax, dword [esi + 0x2ac]
mov dword [ebp - 0xc], eax
fld dword [ebp - 0xc]
fmul dword [0x61f3d0]
call fcn.00404d4c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
fild qword [ebp - 0x30]
fdiv dword [0x61f3d0]
fstp dword [ebp - 0xc]
wait
fld dword [ebp - 0xc]
fstp qword [esi + 0x316]
wait
fld dword [ebp - 0xc]
fstp xword [ebp - 0x20]
wait
mov bl, 2
mov edi, 0xa
mov eax, dword [esi + 0x2c0]
mov dword [ebp - 0x24], eax
movzx eax, word [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
mov eax, dword [0x7a6c88]
push eax
lea eax, [ebp - 8]
push eax
mov eax, ebx
mov ecx, dword [ebp - 0x24]
mov edx, edi
call fcn.004251a0
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004091cc
movzx eax, byte [0x61f3d4]
push eax
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x61f3e4
mov edx, 0x61f3f4
mov eax, dword [ebp - 4]
call fcn.004298b0
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.004091cc
movzx eax, byte [0x61f3d4]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
mov edx, dword [0x7a7048]
movzx edx, word [edx]
call fcn.00409c34
mov edx, dword [ebp - 0x3c]
mov ecx, 0x61f3e4
mov eax, dword [ebp - 4]
call fcn.004298b0
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 4]
call fcn.004091cc
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x31e]
call fcn.00493c64
mov eax, dword [esi + 0x31e]
mov edx, dword [eax]
call dword [edx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61f3c4
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00408e04
lea eax, [ebp - 0x28]
call fcn.00408da4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408e04
ret