joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f49
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [ecx + 0x2c]
xor eax, eax
push edi
add byte [eax], al
je 0x407f78
cmp dword [esi], eax
je 0x407f5e
add byte [0x52e658], bh
test eax, eax
add byte [eax], al
mov eax, dword [esi + 0x14]
test eax, eax
xor byte [eax], al
push eax
call edi
add esi, 0x24
add dword [eax], 0
jne 0x407f5e
test eax, eax
jne 0x407f37
add byte [eax - 0x3e], al
pop eax
add al, ch
xlatb
test dword [eax], 0xc35e5f00
int3

Function at 0x41e4a9
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [ecx + 0x2c]
xor eax, eax
push edi
add byte [eax], al
je 0x41e4d8
cmp dword [esi], eax
je 0x41e4be
add byte [0x52e658], bh
test eax, eax
add byte [eax], al
mov eax, dword [esi + 0x14]
test eax, eax
xor byte [eax], al
push eax
call edi
add esi, 0x24
add dword [eax], 0
jne 0x41e4be
test eax, eax
jne 0x41e497
add byte [eax - 0x3e], al
pop eax
add al, ch
xlatb
test dword [eax], 0xc35e5f00
int3

Function at 0x434b39
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [ecx + 0x2c]
xor eax, eax
push edi
add byte [eax], al
je 0x434b68
cmp dword [esi], eax
je 0x434b4e
add byte [0x52e658], bh
test eax, eax
add byte [eax], al
mov eax, dword [esi + 0x14]
test eax, eax
xor byte [eax], al
push eax
call edi
add esi, 0x24
add dword [eax], 0
jne 0x434b4e
test eax, eax
jne 0x434b27
add byte [eax - 0x3e], al
pop eax
add al, ch
xlatb
test dword [eax], 0xc35e5f00
int3

Function at 0x443e50
Capabilities:
Accept command line arguments
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.pip_master_std_lib_6581D87B52F1
push 1
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test esi, esi
je 0x443eb0
test eax, eax
je 0x443e95
mov edx, dword [0x4b8db4]
lea ecx, [ebp - 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x443eb0
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, 0x68
jmp 0x443eb3
mov esi, dword [ebp - 8]
mov ecx, 0x41
invalid

Function at 0x44ae89
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [ecx + 0x2c]
xor eax, eax
push edi
add byte [eax], al
je 0x44aeb8
cmp dword [esi], eax
je 0x44ae9e
add byte [0x52e658], bh
test eax, eax
add byte [eax], al
mov eax, dword [esi + 0x14]
test eax, eax
xor byte [eax], al
push eax
call edi
add esi, 0x24
add dword [eax], 0
jne 0x44ae9e
test eax, eax
jne 0x44ae77
add byte [eax - 0x3e], al
pop eax
add al, ch
xlatb
test dword [eax], 0xc35e5f00
int3
Function at 0x461169
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [ecx + 0x2c]
xor eax, eax
push edi
add byte [eax], al
je 0x461198
cmp dword [esi], eax
je 0x46117e
add byte [0x52e658], bh
test eax, eax
add byte [eax], al
mov eax, dword [esi + 0x14]
test eax, eax
xor byte [eax], al
push eax
call edi
add esi, 0x24
add dword [eax], 0
jne 0x46117e
test eax, eax
jne 0x461157
add byte [eax - 0x3e], al
pop eax
add al, ch
xlatb
test dword [eax], 0xc35e5f00
int3

Function at 0x477769
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [ecx + 0x2c]
xor eax, eax
push edi
add byte [eax], al
je 0x477798
cmp dword [esi], eax
je 0x47777e
add byte [0x52e658], bh
test eax, eax
add byte [eax], al
mov eax, dword [esi + 0x14]
test eax, eax
xor byte [eax], al
push eax
call edi
add esi, 0x24
add dword [eax], 0
jne 0x47777e
test eax, eax
jne 0x477757
add byte [eax - 0x3e], al
pop eax
add al, ch
xlatb
test dword [eax], 0xc35e5f00
int3

Function at 0x48e519
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [ecx + 0x2c]
xor eax, eax
push edi
add byte [eax], al
je 0x48e548
cmp dword [esi], eax

Function at 0x4a4bd9
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [ecx + 0x2c]
xor eax, eax
push edi
add byte [eax], al
je 0x4a4c08
cmp dword [esi], eax
je 0x4a4bee
add byte [0x52e658], bh
test eax, eax
add byte [eax], al
mov eax, dword [esi + 0x14]
test eax, eax
xor byte [eax], al
push eax
call edi
add esi, 0x24
add dword [eax], 0
jne 0x4a4bee
test eax, eax
jne 0x4a4bc7
add byte [eax - 0x3e], al
pop eax
add al, ch
xlatb
test dword [eax], 0xc35e5f00
int3
Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x402698
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026a6
call dword [0x445014]
or eax, eax
je 0x4026a7
ret
mov al, 1
jmp fcn.00402724

Function at 0x4026b0
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026be
call dword [0x445018]
or eax, eax
jne 0x4026bf
ret
mov al, 2
jmp fcn.00402724

Function at 0x4026c8
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402700
test edx, edx
je 0x4026ea
push eax
mov eax, ecx
call dword [0x44501c]
pop ecx
or eax, eax
je 0x4026f9
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402724
mov dword [eax], edx
mov eax, ecx
call dword [0x445018]
or eax, eax
jne 0x4026e3
ret
mov al, 1
jmp fcn.00402724
test edx, edx
je 0x402714
push eax
mov eax, edx
call dword [0x445014]
pop ecx
or eax, eax
je 0x4026f9
mov dword [ecx], eax
ret

Function at 0x402724
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x446004]
test ecx, ecx
je 0x402734
pop edx
call ecx
dec eax
mov al, byte [eax + 0x40274d]
jns 0x402748
call fcn.00405c24
mov eax, dword [eax + 4]
jmp fcn.00403888

Function at 0x402868
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402897
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403978
jmp 0x4028b5
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004027f0
mov edi, eax
test ebx, ebx
je 0x4028b5
cmp dword [esi], 0
je 0x4028b5
dec ebx
jmp 0x40289e
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402b6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402c04
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402be4
xor eax, eax
push ebp
push 0x402bdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402c20
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402be4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x402e84
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402e9e
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x402e9e
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x402e8a
mov al, 0xa
jmp fcn.00402724
ret

Function at 0x402ed0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x446018], 0
je 0x4028db
call dword [0x446018]
mov eax, 0xd2
jmp fcn.00403888
push eax
push ecx
mov eax, dword [eax]
call fcn.00402ea0
pop ecx
pop eax
je 0x402edf
jmp ebx
pop ecx
jmp 0x4028cc
Function at 0x402ee8
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00402ea0
mov eax, ebx
pop ebx
jne 0x402efd
pop ecx
jmp 0x4028cc
ret

Function at 0x403764
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4464a0
mov esi, 0x446034
mov edi, 0x446038
cmp byte [ebx + 0x24], 0
jne 0x403793
cmp dword [edi], 0
je 0x403793
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403782
cmp dword [0x44603c], 0
je 0x4037da
call fcn.004036e0
cmp byte [0x446044], 0
je 0x4037c0
mov edx, 0x445020
mov eax, 0x446218
call fcn.004054c0
call fcn.00405443
jmp 0x4037d3
push 0
push 0x445040
push 0x445020
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x44603c], eax
cmp byte [ebx + 0x24], 2
jne 0x4037ea
cmp dword [esi], 0
jne 0x4037ea
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.004035b4
cmp byte [ebx + 0x24], 1
jbe 0x4037fa
cmp dword [esi], 0
je 0x403817
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403817
call fcn.00404ec4
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x403817
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.0040358c
cmp byte [ebx + 0x24], 1
jne 0x403825
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403830
call fcn.00403730
cmp dword [ebx], 0
jne 0x40383d
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x4037da

Function at 0x403e9c
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00403e60
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00403e60
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x403e48
ret

Function at 0x403f44
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.00402724
test ecx, ecx
je fcn.00403e60
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x403e48
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x40400c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40404b
cmp al, 0xb
je 0x40404b
cmp al, 0xc
je 0x404055
cmp al, 0xd
je 0x404068
cmp al, 0xe
je 0x404086
cmp al, 0xf
je 0x40404b
cmp al, 0x11
je 0x40404b
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402724
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40404b
jmp 0x40409a
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x404055
jmp 0x40409a
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x40400c
dec edi
jg 0x40406b
pop ebp
jmp 0x40409a
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00403fe0
dec edi
jg 0x404089
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x40400c
Function at 0x4040a0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40404b
cmp al, 0xb
je 0x40404b
cmp al, 0xc
je 0x404055
cmp al, 0xd
je 0x404068
cmp al, 0xe
je 0x404086
cmp al, 0xf
je 0x40404b
cmp al, 0x11
je 0x40404b
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402724
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40404b
jmp 0x40409a
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x404055
jmp 0x40409a
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x40400c
dec edi
jg 0x40406b
pop ebp
jmp 0x40409a
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00403fe0
dec edi
jg 0x404089
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x40400c

Function at 0x4040d8
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x40411f
cmp al, 0xb
je 0x404139
cmp al, 0xc
je 0x404150
cmp al, 0xd
je 0x40415f
cmp al, 0xe
je 0x40417d
cmp al, 0xf
je 0x404193
cmp al, 0x11
je 0x4041a2
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00402724
cmp ecx, 1
mov eax, ebx
jg 0x404130
call fcn.00403894
jmp 0x4041b1
mov edx, ecx
call fcn.004038b8
jmp 0x4041b1
cmp ecx, 1
mov eax, ebx
jg 0x404147
call fcn.00403e60
jmp 0x4041b1
mov edx, ecx
call fcn.00403e78
jmp 0x4041b1
mov eax, ebx
add ebx, 0x10
call fcn.00404934
dec edi
jg 0x404150
jmp 0x4041b1
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004040d8
dec edi
jg 0x404162
pop ebp
jmp 0x4041b1
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004040ac
dec edi
jg 0x404180
pop ebp
jmp 0x4041b1
mov eax, ebx
add ebx, 4
call fcn.00404f8c
dec edi
jg 0x404193
jmp 0x4041b1
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00404b28
dec edi
jg 0x4041a2
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x4041b8
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.004040d8
Function at 0x4041c4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x4041f0
mov edx, eax
add eax, esi
add edx, ebx
call fcn.004027b0
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x40422f
cmp cl, 0xb
je 0x404240
cmp cl, 0xc
je 0x404251
cmp cl, 0xd
je 0x404262
cmp cl, 0xe
je 0x404282
cmp cl, 0xf
je 0x40429b
cmp cl, 0x11
je 0x4042ac
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402724
mov edx, dword [esi + eax]
add eax, ebx
call fcn.004038e8
mov eax, 4
jmp 0x4042bd
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403e9c
mov eax, 4
jmp 0x4042bd
lea edx, [esi + eax]
add eax, ebx
call fcn.00404580
mov eax, 0x10
jmp 0x4042bd
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.004042e0
pop eax
jmp 0x4042bd
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.004041c4
pop eax
jmp 0x4042bd
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404fa4
mov eax, 4
jmp 0x4042bd
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404b64
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x4041de
pop ecx
sub ecx, eax
jle 0x4042d9
lea edx, [ebx + eax]
add eax, esi
call fcn.004027b0
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4042e0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x404326
cmp cl, 0xb
je 0x40433d
cmp cl, 0xc
je 0x404351
cmp cl, 0xd
je 0x404365
cmp cl, 0xe
je 0x404386
cmp cl, 0xf
je 0x4043a3
cmp cl, 0x11
je 0x4043b7
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402724
mov eax, ebx
mov edx, dword [esi]
call fcn.004038e8
add ebx, 4
add esi, 4
dec ebp
jne 0x404326
jmp 0x4043cb
mov eax, ebx
mov edx, dword [esi]
call fcn.00403e9c
add ebx, 4
add esi, 4
dec ebp
jne 0x40433d
jmp 0x4043cb
mov eax, ebx
mov edx, esi
call fcn.00404580
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x404351
jmp 0x4043cb
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.004042e0
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x40436e
jmp 0x4043cb
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.004041c4
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x404386
jmp 0x4043cb
mov eax, ebx
mov edx, dword [esi]
call fcn.00404fa4
add ebx, 4
add esi, 4
dec ebp
jne 0x4043a3
jmp 0x4043cb
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00404b64
add ebx, 4
add esi, 4
dec ebp
jne 0x4043b7
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x404580
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402724
cmp eax, edx
je 0x404617
cmp word [eax], 8
jb 0x4045b8
push eax
push edx
cmp word [eax], 0x100
je 0x4045ae
cmp word [eax], 0x101
je 0x4045a6
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x4045b6
call dword [0x4463e4]
jmp 0x4045b6
add eax, 8
call fcn.00403894
pop edx
pop eax
cmp word [edx], 8
jae 0x4045cf
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x4045ea
cmp word [edx], 0x101
jne 0x404603
push eax
call 0x4045be
pop eax
jmp dword [0x4463ec]
mov edx, dword [edx + 8]
or edx, edx
je 0x4045fa
mov ecx, dword [edx - 8]
inc ecx
jle 0x4045fa
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x404534
ret
Function at 0x404be0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404d98
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404c41
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404db4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404cae
xor eax, eax
push ebp
push 0x404ca7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404c90
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404dd4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404cae
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404d8f
cmp byte [ebp - 0xd], 0
jne 0x404cf0
cmp byte [ebp - 0x12], 0
je 0x404d8f
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404d09
dec ebx
cmp byte [ebx], 0x2e
je 0x404d18
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404d08
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404d8f
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404d45
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404d8f
cmp byte [ebp - 0xd], 0
je 0x404d8f
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404d8f
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409f28
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409f61
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403978
jmp 0x409f6a
mov eax, ebx
mov edx, esi
call fcn.0040392c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409f74
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409f95
mov al, byte [esp]
jmp 0x409f97
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x41554c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x415552
ret

Function at 0x417a00
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x417a51
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x417a38
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x417a28
jmp 0x417a51
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x417a39
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421ddc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x446758], 0
sete dl
or al, dl
jne 0x421f20
mov eax, dword [0x44675c]
mov bx, 0xffff
call fcn.00402ed0
mov eax, dword [0x446758]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x421eef
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x446758]
call fcn.0040eb60
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
je 0x421ee7
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x16c], 0
je 0x421ee7
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x421ee7
mov eax, dword [ebp - 0x10]
call fcn.00429c58
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x421ee7
push ebp
call fcn.00421d98
pop ecx
test al, al
jne 0x421ee7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x8c]
cmp eax, dword [ebp - 0x10]
jne 0x421ea3
mov eax, dword [ebp - 0x10]
call fcn.0042859c
dec eax
jle 0x421ee7
mov byte [ebp - 0x15], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x15]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov bx, 0xffc2
call fcn.00402ed0
cmp byte [ebp - 0x15], 0
je 0x421ee7
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x421ee7
mov edx, dword [ebp - 0x10]
mov eax, dword [0x44675c]
call fcn.00421648
inc edi
dec esi
jne 0x421e36
mov eax, dword [0x44675c]
cmp dword [eax + 8], 0
jle 0x421f07
mov eax, dword [0x44675c]
call fcn.004216d8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x421f20
push ebp
mov eax, dword [ebp - 0x14]
call fcn.00421c50
pop ecx
test al, al
jne 0x421f20
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret