joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, edx
mov dword [ebp - 4], ecx
push esi
mov esi, dword [ebx + 4]
sub esi, dword [ebx]
cmp esi, eax
jb 0x40a83f
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, eax
mov ecx, ebx
push eax
sub edi, esi
call fcn.0040afa0
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
sub eax, ecx
cmp eax, esi
jbe 0x40a890
push 0
lea eax, [ecx + esi]
mov dword [ebp + 8], 0
lea ecx, [ebp + 8]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a887
cmp dword [ebp + 8], edi
jne 0x40a887
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push str.invalid_vector_T__subscript
call fcn.0040ec01
int3

Function at 0x40a970
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
push esi
push edi
mov dword [ebp - 0x24], eax
mov edi, edx
mov dword [ebp - 0x20], eax
mov esi, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov ecx, 0x1000
test eax, eax
cmove eax, ecx
lea ecx, [edi - 1]
add ecx, esi
mov dword [ebp - 0x20], eax
cmp esi, ecx
jae 0x40a9c9
lea esp, [esp]
mov al, byte [esi]
add esi, dword [ebp - 0x20]
cmp esi, ecx
jb 0x40a9c0
mov al, byte [ecx]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40abb0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
test dl, dl
je 0x40ace3
mov ebx, 0x64
movzx eax, dl
push 9
cmp dl, bl
push 0
cmovbe ebx, eax
push ecx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
je 0x40acec
mov eax, 0x5a4d
mov dword [ebp - 0x18], 0x434afc
mov dword [ebp - 0x14], ebx
cmp word [ebx], ax
jne 0x40acec
mov eax, dword [ebx + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x40acec
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x40acec
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40acec
xor esi, esi
xor edi, edi
mov ecx, dword [ebx + 0x3c]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], esi
movzx eax, word [ecx + ebx + 6]
cmp esi, eax
jae 0x40acdc
movzx eax, word [ecx + ebx + 0x14]
lea esi, [ebx + 0x18]
add eax, edi
add esi, ecx
add esi, eax
je 0x40acdc
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0x10]
sbb eax, eax
and eax, 0xfffffff8
mov eax, dword [eax + esi + 0x10]
test eax, eax
je 0x40acd0
mov ecx, dword [ebp - 0x10]
movzx ecx, cl
imul ecx, eax
mov eax, 0x51eb851f
mul ecx
mov ecx, 1
mov eax, edx
shr eax, 5
cmp eax, 1
cmovb eax, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x40acd0
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x40aca0
xor edi, edi
jmp 0x40aca3
lea edi, [eax + ebx]
push edi
lea ecx, [ebp - 0x18]
call fcn.0040d8c0
cmp esi, eax
jne 0x40acec
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x18]
dec eax
add eax, edi
push eax
call fcn.0040d8c0
cmp esi, eax
jne 0x40acec
mov edx, dword [ebp - 4]
mov ecx, edi
call fcn.0040a970
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
inc esi
add edi, 0x28
jmp 0x40ac31
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ad00
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427bef
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x438070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x439a4c], 0
jne 0x40ad6f
push 0x28
call fcn.0040fc09
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00406710
push 0
mov esi, eax
push esi
push 0x439a4c
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x40ad6f
test esi, esi
je 0x40ad6f
push 0x28
push esi
call fcn.0040fea9
add esp, 8
mov eax, dword [0x439a4c]
cmp dword [eax], 1
jle 0x40ae32
push 0
push 0x8000000
push 3
push 0
push 7
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40adc2
test esi, esi
je 0x40adc2
push 4
push 0x1000
push 0x100000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40add6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x10]
push 0
push eax
push 0x100000
push edi
push esi
call ebx
test eax, eax
je 0x40ae09
nop
cmp dword [ebp - 0x10], 0
jbe 0x40ae09
push 0
lea eax, [ebp - 0x10]
push eax
push 0x100000
push edi
push esi
call ebx
test eax, eax
jne 0x40adf0
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 9
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x40adc2
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x40adc2
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x40adc2
mov ecx, 0xe0
cmp word [eax + esi + 0x14], cx
jne 0x40adc2
mov ecx, 0x10b
cmp word [eax + esi + 0x18], cx
jne 0x40adc2
mov eax, dword [eax + esi + 0x50]
or edx, 0xffffffff
cmp eax, 0xffffffff
mov ecx, esi
cmovb edx, eax
call fcn.0040a970
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b1c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x14], 8
jb 0x40b1d6
mov eax, dword [esi]
jmp 0x40b1d8
mov eax, esi
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b1f0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push eax
call fcn.0040feb7
push dword [ebp - 4]
mov edi, eax
push 0
push edi
call fcn.00412b70
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x40b20f
mov esi, dword [esi]
push edi
push dword [ebp - 4]
push dword [ebp - 0xc]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40b25a
lea eax, [ebp - 4]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
push eax
push 0x434890
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40b25a
mov edx, dword [ebp - 8]
test edx, edx
je 0x40b25a
movzx eax, word [edx + 0xa]
lea ecx, [eax + eax*4]
movzx eax, word [edx + 8]
lea eax, [eax + ecx*2]
movzx ecx, word [edx + 0xe]
imul ebx, eax, 0x64
add ebx, ecx
push edi
call fcn.0040f9e5
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bda0
Capabilities:
Enumerate processes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32FirstW]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov edi, edi
push 0x22c
push 0
push edi
call fcn.00412b70
add esp, 0xc
mov dword [edi], 0x22c
cmp byte [esi + 8], 0
push edi
push dword [esi + 4]
jne 0x40bdd8
mov byte [esi + 8], 1
call ebx
jmp 0x40bdde
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
setne al
test al, al
je 0x40bdfa
mov edx, dword [esi]
mov ecx, esi
mov edx, dword [edx + 4]
call edx
test al, al
je 0x40bdb0
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x40c0b0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00410a90
mov eax, dword [0x438070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x800
push 0
push eax
mov edi, ecx
call fcn.00412b70
add esp, 0xc
mov dword [ebp - 0x1008], 1
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x800
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x40c260
mov ecx, dword [ebp - 0x1008]
cmp ecx, 1
jne 0x40c1a3
cmp word [ebp - 0x804], ax
jne 0x40c160
xor ecx, ecx
lea eax, [ebp - 0x804]
push ecx
push eax
mov ecx, ebx
call fcn.00403fd7
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f9d4
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x804]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c170
sub ecx, edx
lea eax, [ebp - 0x804]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.00403fd7
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f9d4
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x40c25b
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x100c], eax
test eax, eax
je 0x40c243
cmp eax, 0x400
ja 0x40c243
cmp word [ebp - 0x1004], 0
jne 0x40c206
xor ecx, ecx
lea eax, [ebp - 0x1004]
push ecx
push eax
mov ecx, ebx
call fcn.00403fd7
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f9d4
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c210
sub ecx, edx
lea eax, [ebp - 0x1004]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.00403fd7
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f9d4
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, 0xea
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f9d4
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f9d4
mov esp, ebp
pop ebp
ret 8
Function at 0x40c280
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
push esi
push edi
mov esi, ecx
lea edi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c290
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 8

Function at 0x40c920
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
push 0x434bd4
mov edi, ecx
call esi
push str.crypt32.dll
mov dword [edi + 4], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 8], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x40c9be
push str.CryptCATAdminCalcHashFromFileHandle
push eax
call esi
push str.CryptCATAdminAcquireContext
push dword [edi + 4]
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push dword [edi + 4]
mov dword [edi + 0x10], eax
call esi
push str.CryptCATCatalogInfoFromContext
push dword [edi + 4]
mov dword [edi + 0x14], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push dword [edi + 4]
mov dword [edi + 0x18], eax
call esi
push str.CryptCATAdminReleaseContext
push dword [edi + 4]
mov dword [edi + 0x1c], eax
call esi
push str.WTHelperProvDataFromStateData
push dword [edi + 4]
mov dword [edi + 0x20], eax
call esi
push str.WTHelperGetProvSignerFromChain
push dword [edi + 4]
mov dword [edi + 0x24], eax
call esi
push str.WinVerifyTrust
push dword [edi + 4]
mov dword [edi + 0x28], eax
call esi
mov dword [edi + 0x2c], eax
mov eax, dword [edi + 8]
test eax, eax
je 0x40c9d0
push str.CertNameToStrW
push eax
call esi
mov dword [edi + 0x30], eax
pop edi
pop esi
ret
Function at 0x40d690
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x438070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x40d7b9
test ecx, ecx
je 0x40d7b9
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40d7b9
push 0x8000
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x68], 0
call fcn.0040feb7
add esp, 4
mov dword [ebp - 0x64], 0
mov esi, eax
push 0
lea eax, [ebp - 0x64]
push eax
push 0x8000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d791
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x40d763
lea edx, [ebp - 0x70]
mov dword [ebp - 0x70], esi
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x6c], eax
call fcn.0040e040
mov eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x64]
push 5
mov dword [ebp - 0x68], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40d721
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x60]
mov ecx, edi
call fcn.0040e160
mov ecx, 0x4346b0
mov edx, 0xc
mov edi, edi
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x40d7b5
add edi, 4
add ecx, 4
sub edx, 4
jae 0x40d780
xor bl, bl
test esi, esi
je 0x40d7a2
push 1
push esi
call fcn.0040fea9
add esp, 8
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f9d4
mov esp, ebp
pop ebp
ret
mov bl, 1
jmp 0x40d793
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f9d4
mov esp, ebp
pop ebp
ret

Function at 0x40d8c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ecx + 4]
push ebx
push esi
push edi
mov ebx, dword [ecx + 0x3c]
xor esi, esi
add ebx, ecx
mov dword [ebp - 4], ecx
xor edi, edi
movzx ecx, word [ebx + 6]
cmp esi, ecx
jae 0x40d919
movzx eax, word [ebx + 0x14]
lea edx, [ebx + 0x18]
add eax, edi
add edx, eax
je 0x40d919
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 4]
add ecx, eax
neg eax
sbb eax, eax
and eax, ecx
cmp eax, dword [ebp + 8]
ja 0x40d908
mov ecx, dword [edx + 8]
add ecx, eax
cmp ecx, dword [ebp + 8]
ja 0x40d90e
inc esi
add edi, 0x28
jmp 0x40d8d6
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40d930
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x40d940
xor al, al
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40d93d
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x40d93d
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete al
ret
Function at 0x402a7c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x423f30]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402af7
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x402afe
cmp dword [ebp + 0x10], ebx
jne 0x402aeb
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a7c
test eax, eax
jne 0x402afe
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
jmp 0x402abe
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405f8e
cmp eax, ebx
je 0x402b23
push ebx
push dword [0x423f30]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402af7
cmp dword [0x423f30], ebx
jne 0x402af4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402af4
jmp 0x402af7

Function at 0x405477
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x422490], 0x44
push eax
xor eax, eax
push 0x422490
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4054b2
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x4042de
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
mov esi, 0x4d13ac
push edi
mov ecx, esi
call fcn.0040a961
lea eax, [ebp - 0x148]
mov byte [0x4d13de], 0
push eax
mov dword [ebp - 0x148], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x144]
mov ecx, esi
mov dword [0x4d13a0], eax
mov eax, dword [ebp - 0x140]
mov dword [0x4d13a4], eax
mov eax, dword [ebp - 0x13c]
mov dword [0x4d13a8], eax
lea eax, [ebp - 0x134]
push eax
call fcn.00406b57
xor eax, eax
or ecx, 0xffffffff
cmp dword [0x4d13b0], eax
ja 0x443617
mov eax, ecx
cmp eax, ecx
jne 0x443656
push ecx
mov esi, 0x4d13ac
push 0
mov ecx, esi
call fcn.004093b2
push 0x49cb64
mov ecx, esi
call fcn.004037a0
mov eax, dword [0x4d13a0]
xor edx, edx
mov word [0x4d13d9], dx
mov dword [0x4d13bc], edx
mov dword [0x4d13c0], edx
mov dword [0x4d13c4], edx
mov dword [0x4d13c8], edx
mov dword [0x4d13cc], edx
mov dword [0x4d13d0], edx
mov dword [0x4d13d4], edx
mov byte [0x4d13d8], dl
push 1
pop ecx
sub eax, 5
je 0x4437df
sub eax, ecx
jne 0x44365d
mov eax, dword [0x4d13a4]
mov byte [0x4d13bd], cl
mov byte [0x4d13bf], cl
test eax, eax
je 0x443726
cmp eax, ecx
je 0x44374d
cmp eax, 2
jne 0x443791
mov byte [0x4d13c7], cl
mov byte [0x4d13c5], cl
mov byte [0x4d13c1], cl
mov byte [0x4d13c9], cl
cmp byte [ebp - 0x2e], cl
jne 0x443780
mov byte [0x4d13c8], cl
lea eax, [ebp - 4]
mov dword [ebp - 4], edx
push eax
invalid
invalid
pushal

Function at 0x4050f5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x443d70
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042e8c4
add esp, 0x10
leave
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov edx, dword [ecx]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x40511b

Function at 0x40693c
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x406964
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x406956
pop edi
pop esi
pop ebp
ret 4
Function at 0x41f98e
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp ebx, esi
jne 0x45f467
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret
push edi
xor edi, edi
test esi, esi
jne 0x45f47c
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push ebx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x45f490
push 9
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
mov dword [ebp - 0x10], edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x45f56b
push edi
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebx
mov dword [ebp - 4], eax
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
call esi
push 1
push edi
push dword [ebp - 4]
call esi
push 1
push dword [ebp - 8]
push edi
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x45f547
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push eax
push eax
push 0x12
call edi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
xor eax, eax
push eax
push eax
push eax
push 0x12
call edi
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, dword [ebp - 0xc]
test eax, eax
je 0x45f54c
push 4
jmp 0x45f549
push 3
pop ebx
jmp 0x45f54f
mov ebx, dword [ebp - 0x10]
push 0
push dword [ebp - 8]
push dword [ebp - 4]
call esi
push 0
push edi
push dword [ebp - 4]
call esi
push 0
push dword [ebp - 8]
push edi
call esi
jmp 0x45f56e
push 2
pop ebx
mov eax, ebx
pop edi
jmp 0x41f9ab

Function at 0x43d1d0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043ce90

Function at 0x45a843
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
ret
Function at 0x46b0a8
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
test esi, esi
js 0x46b12c
jne 0x46b0bb
push 0
jmp 0x46b126
cmp esi, 0xf
jae 0x46b125
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x46b125
mov dword [ebp - 4], esi
fild dword [ebp - 4]
test esi, esi
jns 0x46b0de
fadd qword [0x4c81c0]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fstp qword [ebp - 0x28]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
sbb eax, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
fild qword [ebp - 8]
fstp qword [ebp - 0x20]
call fcn.0041e398
fdivr qword [ebp - 0x20]
fcomp qword [ebp - 0x28]
fnstsw ax
test ah, 5
jnp 0x46b0e7
jmp 0x46b12c
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
leave

Function at 0x46b27a
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.00469f7e
mov eax, dword [ebp + 8]
mov word [esi + 8], ax
test ax, ax
je 0x46b2d8
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
je 0x46b2d8
push ebx
mov ebx, eax
mov byte [esi], al
push 0
movzx eax, al
push eax
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
test bl, 1
je 0x46b2c1
mov byte [esi + 1], 1
test bl, 2
je 0x46b2ca
mov byte [esi + 3], 1
test bl, 4
pop ebx
je 0x46b2d4
mov byte [esi + 4], 1
mov al, 1
jmp 0x46b2da
xor al, al
pop esi
pop ebp
ret 4

Function at 0x46ccff
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 8], edi
je 0x46cd19
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call fcn.0046cc37
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], edi
pop edi
pop esi
leave
ret 8