joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ccd84
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x59233c
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x4cce48
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x4ccdbc
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x4cce5f
dec edx
je 0x4ccea0
jmp 0x4ccefd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x4ccefd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ccf60
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x4ccf7d
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x4cd08f
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x4ccfb0
je 0x4ccffc
sub ecx, 0x2b
je 0x4ccff2
sub ecx, 4
je 0x4ccff7
dec ecx
sub ecx, 0xa
jb 0x4ccfe1
jmp 0x4ccfff
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4ccfc2
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4ccfd0
jmp 0x4ccfff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4ccfff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4ccfff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4ccfff
mov byte [eax], 0x3e
jmp 0x4ccfff
mov byte [eax], 0x3f
jmp 0x4ccfff
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4ccf8f
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x4cd04f
cmp byte [esp + 3], 0xff
jne 0x4cd04f
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x4cd087
cmp dl, 0xff
je 0x4cd087
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x4ccf88
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x4cd11c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x5a37a0
mov eax, ebx
mov edx, 8
test al, 1
je 0x4cd138
shr eax, 1
xor eax, 0xedb88320
jmp 0x4cd13a
shr eax, 1
dec edx
jne 0x4cd12b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x4cd124
pop ebx
ret
Function at 0x4cd150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4cd159
mov eax, dword [ebp - 4]
add esp, 0xfffffebc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004c4a38
xor eax, eax
push ebp
push 0x4cd239
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004cd11c
mov eax, dword [0x5a2e0c]
mov byte [eax], 0
mov dword [ebx], 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.004c2e7c
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.004c3218
call fcn.004c2ba8
test eax, eax
jne 0x4cd216
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10145]
mov ecx, 0xfff1
lea eax, [ebp - 0x154]
call fcn.004c2fcc
mov dx, word [ebp - 8]
test dx, dx
jbe 0x4cd210
lea eax, [ebp - 0x10145]
xor ecx, ecx
mov cl, byte [eax]
mov esi, dword [ebx]
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + 0x5a37a0]
mov esi, dword [ebx]
shr esi, 8
xor ecx, esi
mov dword [ebx], ecx
inc eax
dec dx
jne 0x4cd1ec
cmp dword [ebp - 8], 0
jne 0x4cd1c3
lea eax, [ebp - 0x154]
call fcn.004c2fec
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd240
lea eax, [ebp - 4]
call fcn.004c4588
ret

Function at 0x4d8718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4d8738
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4d8726
pop edi
pop esi
pop ebx
ret
Function at 0x4e0fd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov ebx, 0x5a3cb4
mov eax, ebp
shr eax, 1
and eax, 0xff
mov dword [esp], eax
mov esi, ebp
and esi, 1
mov eax, ebp
and eax, 0x200
shr eax, 8
or esi, eax
mov edx, dword [esi*4 + 0x598670]
mov eax, dword [esi*4 + 0x5986b0]
xor eax, dword [esp]
call fcn.004e0f70
mov edi, eax
shl edi, 0x18
mov eax, edi
call fcn.004e0fac
mov dword [ebx], eax
mov edx, dword [esi*4 + 0x598680]
mov eax, dword [esi*4 + 0x5986c0]
xor eax, dword [esp]
call fcn.004e0f70
mov edi, eax
shl edi, 0x10
mov eax, edi
call fcn.004e0fac
mov dword [ebx + 0x1000], eax
mov edx, dword [esi*4 + 0x598690]
mov eax, dword [esi*4 + 0x5986d0]
xor eax, dword [esp]
call fcn.004e0f70
mov edi, eax
shl edi, 8
mov eax, edi
call fcn.004e0fac
mov dword [ebx + 0x2000], eax
mov edx, dword [esi*4 + 0x5986a0]
mov eax, dword [esi*4 + 0x5986e0]
xor eax, dword [esp]
call fcn.004e0f70
mov edi, eax
mov eax, edi
call fcn.004e0fac
mov dword [ebx + 0x3000], eax
inc ebp
add ebx, 4
cmp ebp, 0x400
jne 0x4e0fe0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4e1138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x4c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, 3
jne 0x4e116d
xor ebx, ebx
mov eax, ebx
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [eax + ecx]
and edx, 3
mov esi, dword [ebp - 8]
lea edx, [esi + edx*2]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
and dx, 1
movzx edx, dx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add esi, esi
or esi, edx
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
mov esi, dword [ebp - 0x1c]
movzx esi, word [esi]
shr esi, 1
xor dx, 1
shl edx, 0xf
or si, dx
mov edx, dword [ebp - 0x1c]
mov word [edx], si
inc eax
cmp eax, 4
jne 0x4e1193
inc ebx
cmp ebx, 0xf
jne 0x4e117d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x4e114f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5c5293
Capabilities:
Hash data with md5

Disassembly:
push ax
lea esp, [esp + 1]
lea esp, [esp + 1]
mov dword [eax + 4], 0
jmp 0x5c5356
push si
push word [esp + 1]
lea esp, [esp + 4]
lea esp, [esp + 4]
jmp 0x5c5275
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
jmp 0x5c5334
Function at 0x5c5ad5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push cx
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x5c5aed
push edx
lea esp, [esp + 4]
mov eax, dword [esp + 4]
push edi
mov edi, ecx
test eax, eax
je 0x6020fc
jmp 0x6020df

Function at 0x5ed88d
Capabilities:
Hash data with md5

Disassembly:
call fcn.005c4add
jmp 0x5c5270

Function at 0x5ed8e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
lea esp, [esp + 4]
pushfd
lea esp, [esp + 4]
jmp fcn.005c5aa0

Function at 0x5edb5b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 4]
pushal
lea esp, [esp + 0x20]
jmp 0x5c5b10

Function at 0x5edb8f
Capabilities:
Hash data with md5

Disassembly:
pushal
mov dx, 0x53bc
popal
push eax
push dword [esp + 3]
mov byte [esp + 1], al
jmp 0x5edbbd
pop word [esp]
lea esp, [esp]
lea esp, [esp + 2]
lea esp, [esp + 4]
pushal
jmp 0x5edc8b
mov dword [esp + 3], edx
lea esp, [esp + 8]
pushfd
push word [esp + 0x16]
lea esp, [esp + 0xe]
mov dword [esp + 0xb], eax
mov eax, 0x4c6c77a7
bswap eax
mov ax, 0x3b51
mov ax, 0x63f9
push edx
setle al
lea esp, [esp + 3]
mov al, byte [esp]
xchg byte [esp], ah
lea esp, [esp]
mov ax, 0x3db0
mov al, byte [esp]
mov ax, 0x3cf7
lea esp, [esp + 1]
mov dword [esp + 2], ecx
setne cl
mov cx, 0x5e7e
mov cx, word [esp]
setbe ah
mov ch, 0x4f
not ecx
mov ax, si
mov ecx, dword [esp + 2]
mov al, dl
lea eax, [eax*4]
mov ah, 0xe6
bswap ax
mov ax, 0x732e
lea eax, [edi*4]
lea eax, [ebx - 0x9c]
xchg ah, al
not eax
mov ah, 0x8f
mov eax, dword [esp + 0xb]
lea esp, [esp + 0x10]
jmp 0x5c5270

Function at 0x5edc12
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.005c5aa5
jmp 0x5c5ad0

Function at 0x5ee601
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.005c5ad5
jmp 0x5c5b10

Function at 0x5ee65d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
mov dword [esp], ecx
lea esp, [esp + 4]
pushfd
push dword [esp + 3]
lea esp, [esp + 8]
jmp fcn.005c5aa0
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40596d
pop dword [ebp - 0x48]
mov eax, 0x3e07f99a
sub eax, 0x3dc7a02d
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x38e833fa
sub dword [ebp - 0x58], 0xea95eeaf
mov dword [ebp - 0x54], 0xfd0524a0
add dword [ebp - 0x54], 0x352e27a5
mov dword [ebp - 0x50], 0xd7fb4545
sub dword [ebp - 0x50], 0x8baf0117
mov dword [ebp - 0x4c], 0x87ecc0e3
sub dword [ebp - 0x4c], 0x87ecc0e3
lea eax, [ebp - 0x58]
push eax
mov eax, 0x26a27333
add eax, 0xd99dfd2d
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x93ea32df
sub dword [ebp - 0x58], 0x1f77c989
mov dword [ebp - 0x54], 0x316b0075
add dword [ebp - 0x54], 0x10016100
mov dword [ebp - 0x50], 0x3991fbb2
add dword [ebp - 0x50], 0x29dd70ba
mov dword [ebp - 0x4c], 0x614a9434
add dword [ebp - 0x4c], 0x9eb56bcc
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3bea7
push 0
call eax
mov ecx, 0x226dbf3b
sub ecx, 0x226d626f
mov ebx, eax
mov esi, 0xdb95352b
sub esi, 0xdb54352b
add esi, dword [ebp - 0x48]
mov edi, 0xea995291
sub edi, 0x87042c78
sub dword [ebp - 0x28], 0x984602a1
mov edx, dword [esi]
add dword [ebp - 0x18], ebx
xor edx, edi
sub dword [ebp - 0x3c], edx
mov dword [ebx], edx
sub dword [ebp - 0x34], ebx
add ebx, 4
add esi, 0x2dce9f51
add esi, 0xd23160b3
loop 0x405a8a
add eax, 0xd5744d60
sub eax, 0xd572e75d
mov ebx, eax
add eax, 0x54bb2401
sub eax, 0x54bb23fc
mov ecx, 0xbe5f1cd4
add ecx, 0x41e0e32c
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x402a40
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004043c0
test esi, esi
jne 0x402a76
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004044b0
jmp 0x402a94
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402954
mov edi, eax
test esi, esi
je 0x402a94
cmp dword [ebx], 0
je 0x402a94
dec esi
jmp 0x402a7d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4034dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45400c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403574
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403554
xor eax, eax
push ebp
push 0x40354d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403590
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403554
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x45400c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45400c], ax
mov esp, ebp
pop ebp
ret

Function at 0x404244
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45604c], 0
je 0x4042a5
cmp word [0x456220], 0xd7b2
jne 0x40426d
cmp dword [0x456228], 0
jbe 0x40426d
mov eax, 0x45621c
call dword [0x456238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x454054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4042cc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45401c], 0
jne 0x4042c1
push 0
push 0x454074
push 0x454054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405d68
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f98
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405deb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f98
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405deb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405fb4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405e74
xor eax, eax
push ebp
push 0x405e6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405bb0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405e52
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405fd4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405e52
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405e74
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405f8e
cmp byte [ebp - 0xd], 0
jne 0x405ebb
cmp byte [ebp - 0x12], 0
je 0x405f8e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405ed4
dec ebx
cmp byte [ebx], 0x2e
je 0x405ee3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405ed3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405f8e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405f20
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405f8e
cmp byte [ebp - 0xd], 0
je 0x405f8e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405f8e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4087a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404870
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4087c1
test al, 0x10
jne 0x4087c5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40a1b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a1ed
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004044b0
jmp 0x40a1f6
mov eax, ebx
mov edx, esi
call fcn.00404414
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a200
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a221
mov al, byte [esp]
jmp 0x40a223
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a8a8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40a720
mov eax, dword [0x454fd0]
cmp byte [eax], 0
je 0x40a915
mov eax, dword [0x454e20]
call fcn.00402df8
call fcn.00402880
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408a2c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a95c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a94b
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x454ddc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x456718]
call fcn.00405b74
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40b4c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b528
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404628
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004085f4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b52f
lea eax, [ebp - 0xc]
call fcn.004043c0
ret
Function at 0x421874
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x456a24
cmp dword [edi], 0
jne 0x4218f0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x456a20]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4545d8
mov ecx, 2
call fcn.00402914
mov edx, 0x42184c
lea eax, [esi + 5]
call fcn.0042186c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0042186c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4218c5
mov dword [0x456a20], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x422cd8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x422cde
ret

Function at 0x425120
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x425171
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x425158
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x425148
jmp 0x425171
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x425159
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c128
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x42c074
call sub.user32.dll_EnumWindows
ret

Function at 0x42c24c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x42c2c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0042bc98
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x42c271
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0042b8f0
cmp dword [ebp - 4], 0
je 0x42c2b3
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404870
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c2d0
lea eax, [ebp - 4]
call fcn.004043c0
ret

Function at 0x42ffac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x42fffc]
test si, 4
je 0x42ffc0
or bl, 1
test si, 8
je 0x42ffca
or bl, 4
test si, 1
je 0x42ffd4
or bl, 8
test si, 2
je 0x42ffde
or bl, 0x10
test si, 0x10
je 0x42ffe8
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x42fff7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x430038]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x430019
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x430028
or bl, 4
test esi, 0x20000000
je 0x430033
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret