joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429550
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x410b38]
call fcn.00405f7c
xor eax, eax
push ebp
push 0x4296f1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x53ac68], 0
jne 0x4295ab
mov ecx, dword [0x542dc4]
mov dl, 1
mov eax, dword [0x408c0c]
call fcn.0040e8d4
call fcn.00404b1c
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.004039c4
mov eax, ebx
call fcn.00405b98
mov dword [ebp - 0x24], eax
mov esi, 0x429700
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00407138
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405ba8
test eax, eax
jle 0x429694
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x429680
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405414
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x429626
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405448
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x42963c
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405448
mov eax, dword [ebp - 0x54]
call fcn.00405650
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405414
mov eax, dword [ebp - 0x58]
call fcn.00405650
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x429682
xor eax, eax
test al, al
je 0x42968d
mov ebx, 0x15
jmp 0x429699
mov ebx, 0x10
jmp 0x429699
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x53ac68]
call fcn.004293d0
mov eax, dword [ebp - 4]
call fcn.004293d0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00407150
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4296f8
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.004051c8
lea eax, [ebp - 0xc]
mov edx, dword [0x410b38]
call fcn.0040604c
ret
Function at 0x42c060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00405650
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x42c0b8
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5435f8]
mov dl, 1
mov eax, dword [0x42bb6c]
call fcn.0040e910
call fcn.00404b1c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042bc74
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42dce4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x42dd48
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00405414
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.0040a644
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42dd4f
lea eax, [ebp - 0xc]
call fcn.004051a4
ret

Function at 0x42dde8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x42de44
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x42de13
call fcn.0040ff6c
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00403158
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x42de44
call fcn.0040ff6c
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x438ce4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x438dac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004051a4
xor eax, eax
push ebp
push 0x438d86
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.00405650
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov ebx, eax
test ebx, ebx
jle 0x438d7c
inc ebx
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x438cbc]
call fcn.00406a48
add esp, 4
push ebx
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.00405650
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
test eax, eax
je 0x438d64
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.0040539c
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x438cbc]
call fcn.00406a48
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x438d90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438db3
lea eax, [ebp - 4]
mov edx, dword [0x438cbc]
call fcn.00406a54
ret

Function at 0x43948c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004051a4
xor edx, edx
push ebp
push 0x439518
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x201]
push eax
push 0
push 0
push esi
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, 0x80000000
sete al
test al, al
je 0x43950e
mov edx, ebx
lea eax, [ebp - 0x201]
call fcn.0040b2a4
cmp dword [ebx], 0
je 0x43950e
mov eax, dword [ebx]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x4394f9
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x43950e
mov eax, ebx
mov edx, 0x439534
call fcn.0040548c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x439522
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439b98
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x439d15
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x439ced
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.00436a08
cmp al, 9
jb 0x439c7b
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.004058e0
xor edx, edx
push ebp
push 0x439c74
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00405650
push eax
push 0
push 0
push 0x23
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, eax
jne 0x439c5c
mov eax, dword [ebp - 4]
call fcn.00405650
mov edx, dword [ebp - 8]
call fcn.0040b2a4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x439c2e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x439c4a
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040f560
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004051f8
call fcn.00404bc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x439cf7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439c7b
lea eax, [ebp - 4]
xor edx, edx
call fcn.004058e0
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x542fdc]
mov eax, dword [eax]
mov ecx, 0x439d2c
mov edx, 0x439d44
call fcn.00434d2c
test al, al
je 0x439ce3
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x439caf
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x439ce3
mov eax, dword [ebp - 8]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x439cc7
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x5c
je 0x439ce3
mov eax, dword [ebp - 8]
mov edx, 0x439d90
call fcn.0040548c
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x439cf7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439d1c
lea eax, [ebp - 0x10]
call fcn.004051a4
lea eax, [ebp - 4]
call fcn.004051a4
ret
Function at 0x439d94
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x439f2a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x439efd
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.00436a08
cmp al, 9
jb 0x439e73
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.004058e0
xor edx, edx
push ebp
push 0x439e6c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00405650
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, eax
jne 0x439e54
mov eax, dword [ebp - 4]
call fcn.00405650
mov edx, dword [ebp - 8]
call fcn.0040b2a4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x439e26
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x439e42
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040f560
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004051f8
call fcn.00404bc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x439f07
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439e73
lea eax, [ebp - 4]
xor edx, edx
call fcn.004058e0
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x5430fc]
mov eax, dword [eax]
mov ecx, 0x439f40
mov edx, 0x439f50
call fcn.00434d2c
test al, al
je 0x439ef3
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00438f50
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004051f8
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x439ebf
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x439ef3
mov eax, dword [ebp - 8]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x439ed7
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x5c
je 0x439ef3
mov eax, dword [ebp - 8]
mov edx, 0x439f9c
call fcn.0040548c
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x439f07
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439f31
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004051c8
lea eax, [ebp - 4]
call fcn.004051a4
ret

Function at 0x43c1c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00405640
xor eax, eax
push ebp
push 0x43c224
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.00405650
push eax
mov eax, esi
call fcn.00405650
push eax
mov eax, ebx
call fcn.00405650
push eax
push 0x43c234
push edi
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c22b
lea eax, [ebp + 8]
call fcn.004051a4
ret
Function at 0x43c23c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00405640
xor eax, eax
push ebp
push 0x43c2a0
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.00405650
push eax
mov eax, esi
call fcn.00405650
push eax
mov eax, ebx
call fcn.00405650
push eax
push 0x43c2b0
push edi
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c2a7
lea eax, [ebp + 8]
call fcn.004051a4
ret

Function at 0x43c634
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00405640
xor eax, eax
push ebp
push 0x43c6ff
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x43c6d7
push dword fs:[edx]
mov dword fs:[edx], esp
test bl, bl
je 0x43c68a
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00409ce0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.0040523c
mov ecx, 1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x43c69b
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x43c6ca
mov esi, 1
imul eax, ecx, 0x5517e877
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + esi - 1]
xor ecx, dword [eax*4 + 0x53add0]
inc esi
dec ebx
jne 0x43c6a6
mov dword [ebp - 0x10], ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43c6e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c706
lea eax, [ebp - 0x14]
call fcn.004051a4
lea eax, [ebp - 0xc]
call fcn.004051a4
ret
Function at 0x43c710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405640
xor eax, eax
push ebp
push 0x43c810
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor edx, edx
push ebp
push 0x43c7e8
push dword fs:[edx]
mov dword fs:[edx], esp
test bl, bl
je 0x43c76f
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00409ce0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.0040523c
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x43c789
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x43c7d2
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00406540
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x53b1d4]
mov eax, dword [eax*8 + 0x53b1d0]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x43c794
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43c7f2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c817
lea eax, [ebp - 0x1c]
call fcn.004051a4
lea eax, [ebp - 4]
call fcn.004051a4
ret

Function at 0x43e2b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405640
xor eax, eax
push ebp
push 0x43e367
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
push ebp
push 0x43e33f
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040a024
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0040523c
cmp dword [ebp - 4], 0
jne 0x43e313
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43e349
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405650
push eax
push 0x43e37c
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
setg byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43e349
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e36e
lea eax, [ebp - 0xc]
call fcn.004051a4
lea eax, [ebp - 4]
call fcn.004051a4
ret
Function at 0x447128
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x447299
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x447279
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, edi
call fcn.00446f4c
mov eax, dword [ebp - 4]
call fcn.00438560
test al, al
je 0x447172
mov eax, dword [ebp - 4]
call fcn.00438490
mov eax, dword [edi + 5]
cmp dword [eax + 8], 0
jle 0x44726f
mov dl, 1
mov eax, dword [0x419d20]
call fcn.00404238
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x447268
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4472b0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [edi + 5]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4471d9
inc ebx
mov dword [ebp - 8], 0
mov eax, dword [edi + 5]
mov edx, dword [ebp - 8]
call fcn.00428d68
mov esi, eax
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00446cc4
inc dword [ebp - 8]
dec ebx
jne 0x4471bc
mov edx, 0x4472c4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebp - 4]
call fcn.00438560
test al, al
je 0x447252
cmp byte [edi + 4], 0
je 0x44720c
mov dword [ebp - 0x10], 0x80000001
jmp 0x447213
mov dword [ebp - 0x10], 0x80000002
mov eax, dword [edi + 5]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x447252
inc ebx
mov dword [ebp - 8], 0
mov eax, dword [edi + 5]
mov edx, dword [ebp - 8]
call fcn.00428d68
mov esi, eax
movzx eax, byte [esi + 0x11]
call fcn.00444504
mov ecx, dword [esi + 9]
mov edx, 0x4472d8
mov eax, dword [ebp - 0x10]
call fcn.00435494
inc dword [ebp - 8]
dec ebx
jne 0x447226
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44726f
mov eax, dword [ebp - 0xc]
call fcn.00404268
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x447283
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4472a0
lea eax, [ebp - 4]
call fcn.004051a4
ret

Function at 0x44eb8c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x44eb92
ret
Function at 0x468bac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
mov edi, eax
test bl, bl
je 0x468bcd
test edi, 0x40000
je 0x468be7
test bl, bl
jne 0x468c68
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x468c68
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x468c1a
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x468c2f
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
jmp 0x468c3e
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x468c4f
cmp byte [esp + 2], 0
je 0x468c68
cmp byte [esp + 2], 0
je 0x468c60
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x468c68
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x468f0c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x468f32
mov eax, esp
push eax
push 0x468ed4
call sub.user32.dll_EnumWindows
jmp 0x468f45
mov eax, esp
push eax
push 0x468eb4
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x468fd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x469024]
test si, 4
je 0x468fe5
or bl, 1
test si, 8
je 0x468fef
or bl, 4
test si, 1
je 0x468ff9
or bl, 8
test si, 2
je 0x469003
or bl, 0x10
test si, 0x10
je 0x46900d
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46901c
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x469028
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x469064]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x469042
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x469051
or bl, 4
test esi, 0x20000000
je 0x46905c
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4690b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.00469068
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret
Function at 0x47110c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x47111e
add esp, 0xfffffff0
call fcn.004045cc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004258d0
mov eax, dword [0x542f28]
mov dword [eax + 4], ebx
mov dword [eax], 0x4714b0
mov eax, dword [0x542f34]
mov dword [eax + 4], ebx
mov dword [eax], 0x4714bc
mov eax, ebx
call fcn.004714c8
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4196b4]
call fcn.00404238
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4196b4]
call fcn.00404238
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4196b4]
call fcn.00404238
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4196b4]
call fcn.00404238
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4196b4]
call fcn.00404238
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x46c954
push eax
push 0
push 0
mov eax, dword [0x5431c8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x44de18]
call fcn.0044f70c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x44de18]
call fcn.0044f70c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x44de18]
call fcn.0044f70c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00471940
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x471810
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x471810
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x471810
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x47125b
call fcn.00404624
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret