joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fea0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff800
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.0040a40c
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.0040ae70
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
mov ebx, eax
cmp ebx, 0x400
jge 0x42fee5
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.0040a5a4
jmp 0x42fefe
mov edx, ebx
dec edx
mov eax, esi
call fcn.0040affc
push ebx
mov eax, dword [esi]
call fcn.0040ae70
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
add esp, 0x800
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4321d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x4321f4
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x43220e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x432209
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x432213
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x432281
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x4322ca
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x43223f
inc dword [ebp - 0xc]
jmp 0x432257
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x432257
cmp dword [ebp - 0xc], 0
jle 0x432257
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x432279
xor eax, eax
jmp 0x432275
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x432274
mov eax, esi
jmp 0x4322cd
inc eax
cmp eax, ecx
jle 0x432261
inc esi
cmp esi, dword [ebp - 8]
jl 0x43222b
jmp 0x4322ca
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x4322ca
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x4322a2
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x4322c4
xor eax, eax
jmp 0x4322c0
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x4322bf
mov eax, esi
jmp 0x4322cd
inc eax
cmp eax, ecx
jle 0x4322ac
inc esi
cmp esi, dword [ebp - 8]
jl 0x43228a
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4324dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x4324fb
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x43250b
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x43262d
test ebx, ebx
jl 0x43262d
test esi, esi
jle 0x43262d
mov eax, dword [ebp - 8]
call fcn.0040ae70
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040ae70
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x4325ca
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x43262d
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x4325af
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x43257e
inc dword [ebp - 0x14]
jmp 0x43258e
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x43258e
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x432599
or eax, 0xffffffff
jmp 0x4325af
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x4325ac
inc eax
jmp 0x4325af
or eax, 0xffffffff
test eax, eax
jl 0x4325b7
cmp esi, eax
jg 0x43256c
cmp esi, eax
jg 0x4325c2
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x432630
inc edx
dec dword [ebp - 0x1c]
jne 0x432568
jmp 0x43262d
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x43262d
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x432614
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x4325f3
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x4325fe
or eax, 0xffffffff
jmp 0x432614
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x432611
inc eax
jmp 0x432614
or eax, 0xffffffff
test eax, eax
jl 0x43261c
cmp esi, eax
jg 0x4325dc
cmp esi, eax
jg 0x432627
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x432630
inc edx
dec dword [ebp - 0x1c]
jne 0x4325d8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x441d5c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x441d64
mov eax, edx
pop esi
pop ebx
ret
Function at 0x4513e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x4513f4
add esp, 0xfffffff0
call fcn.00408c50
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x44b47c]
call fcn.0046eec0
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x45041c]
call fcn.00471c90
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x45041c]
call fcn.00471c90
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x451449
call fcn.00408ca8
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c0764
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4c07a7
cmp byte [ebx + 0x11], 0
jne 0x4c07a7
cmp byte [ebx + 0x24], 0
jne 0x4c07a7
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4c07be
mov ecx, dword [0x6a3e38]
mov dl, 1
mov eax, dword [0x48c514]
call fcn.0042c830
call fcn.00409b04
pop ebx
ret
mov ecx, dword [0x6a3e38]
mov dl, 1
mov eax, dword [0x48c514]
call fcn.0042c830
call fcn.00409b04
pop ebx
ret

Function at 0x4c112c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4c117a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004c0610
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c1193
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4c119c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004c0610
dec esi
jne 0x4c11be
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4c3e94
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x6ab8bc
cmp dword [edi], 0
jne 0x4c3f10
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x6ab8b8]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x69e3b4
mov ecx, 2
call fcn.004073f0
mov edx, 0x4c3e6c
lea eax, [esi + 5]
call fcn.004c3e8c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004c3e8c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4c3ee5
mov dword [0x6ab8b8], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4dd650
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x4dd667
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x4dd657
mov eax, ecx
pop ebx
ret
Function at 0x50da98
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x50dc57
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a844
mov eax, dword [ebp - 4]
call fcn.0050d3e4
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x50daea
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040b28c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0050e6ec
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x50dbcb
xor eax, eax
push ebp
push 0x50dbc4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0050d684
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0050dc8c
test al, al
je 0x50dba0
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040a5a4
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x50dba0
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040ae70
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0050d5e4
test al, al
je 0x50db9a
mov eax, dword [ebp - 8]
call fcn.0040ae70
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040aed0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.0050da98
dec ebx
cmp ebx, 0xffffffff
jne 0x50db49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50dbcb
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0050d684
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
cmp byte [0x6ab918], 0
je 0x50dc0b
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae70
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0050d670
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0050d5e4
mov ebx, eax
jmp 0x50dc32
mov eax, dword [ebp - 4]
call fcn.0040ae70
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0050d670
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0050d5e4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50dc5e
lea eax, [ebp - 0x3c]
call fcn.0040a40c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a46c
pop eax
jmp eax
Function at 0x50dcfc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x50ddb6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0050dc8c
test al, al
je 0x50dd96
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a5a4
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x50dd96
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae70
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.0040ae70
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040aed0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
dec ebx
jne 0x50dd4f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ddbd
lea eax, [ebp - 0x2c]
call fcn.0040a40c
lea eax, [ebp - 4]
call fcn.0040a40c
pop eax
jmp eax

Function at 0x50e5c8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.0050d3fc
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040ae70
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.0050d5e4
test al, al
jne 0x50e630
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x6a3c04]
mov dl, 1
mov eax, dword [0x50c1c8]
call fcn.0042c904
call fcn.00409b04
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x50e63c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040ae70
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.0050d5e4
test al, al
jne 0x50e69d
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x6a42ec]
mov dl, 1
mov eax, dword [0x50c1c8]
call fcn.0042c904
call fcn.00409b04
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0050d42c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x50ecb4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x50ede0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.0050d684
xor eax, eax
push ebp
push 0x50edb9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050dc8c
test al, al
je 0x50ed9b
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0050eb8c
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a5a4
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x50ed9b
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae70
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050d5e4
test al, al
je 0x50ed97
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae70
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040aed0
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0050eb8c
pop ecx
inc edi
dec ebx
jne 0x50ed3f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50edc0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.0050d684
pop eax
jmp eax
Function at 0x50edf0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x50f048
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.0050d684
xor eax, eax
push ebp
push 0x50f01c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050dc8c
test al, al
je 0x50effe
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a5a4
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x50effe
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae70
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050d5e4
test al, al
je 0x50eff2
mov eax, dword [ebp - 4]
call fcn.0040ae70
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040aed0
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050e6ec
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x50eff2
xor eax, eax
push ebp
push 0x50efeb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.0050d684
xor eax, eax
push ebp
push 0x50efcb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040ae70
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040aed0
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050d688
mov eax, dword [ebp - 4]
call fcn.0040ae70
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040aed0
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050e6ec
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x50efa6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0050ecb4
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0050edf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50efad
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x50ee7b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f023
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.0050d684
pop eax
jmp eax
Function at 0x518338
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x51833e
ret

Function at 0x51f134
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, esi
call fcn.0051efc4
lea edx, [ebp - 0x22]
mov ecx, 0x16
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 0x22], 0x9ac6cdd7
jne 0x51f176
lea eax, [ebp - 0x22]
call fcn.0051bff8
cmp ax, word [ebp - 0xe]
je 0x51f17b
call fcn.0051af90
sub dword [ebp - 8], 0x16
mov eax, dword [ebp - 8]
call fcn.00406fe8
mov dword [ebp - 0xc], eax
mov ebx, dword [esi + 0x30]
xor eax, eax
push ebp
push 0x51f2a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esi + 0x30]
movzx edx, word [ebp - 0x14]
mov word [eax + 0x18], dx
cmp word [ebp - 0x14], 0
jne 0x51f1c1
mov word [ebp - 0x14], 0x60
movzx eax, word [ebp - 0x14]
push eax
push 0x9ec
movsx eax, word [ebp - 0x18]
movsx edx, word [ebp - 0x1c]
sub eax, edx
push eax
call sub.kernel32.dll_MulDiv
mov dword [ebx + 0xc], eax
movzx eax, word [ebp - 0x14]
push eax
push 0x9ec
movsx eax, word [ebp - 0x16]
movsx edx, word [ebp - 0x1a]
sub eax, edx
push eax
call sub.kernel32.dll_MulDiv
mov dword [ebx + 0x10], eax
mov dword [ebp - 0x34], 8
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SetWinMetaFileBits
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x51f232
call fcn.0051af90
lea eax, [ebp - 0xa0]
push eax
push 0x6c
mov eax, dword [ebx + 8]
push eax
call sub.gdi32.dll_GetEnhMetaFileHeader
mov dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 8]
push eax
call sub.gdi32.dll_DeleteEnhMetaFile
lea eax, [ebp - 0x34]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SetWinMetaFileBits
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x51f286
call fcn.0051af90
mov byte [esi + 0x34], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51f2ac
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00407004
pop eax
jmp eax
Function at 0x53bca4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x6abb00], 0
je 0x53bde5
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x6a3db4]
mov edx, dword [edx]
xor al, byte [edx + 0xd4]
je 0x53bde5
mov eax, dword [0x6abb04]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x6abb00]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x53bdb4
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x6abb00]
call fcn.004ab4c8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x53bdac
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x21d], 0
je 0x53bdac
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x7c]
test al, al
je 0x53bdac
mov eax, dword [ebp - 0x14]
call fcn.00548834
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x53bdac
push ebp
call fcn.0053bc60
pop ecx
test al, al
jne 0x53bdac
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffb9
call fcn.00408a34
test al, al
je 0x53bdac
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffba
call fcn.00408a34
cmp byte [ebp - 1], 0
je 0x53bdac
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.00413674
test al, al
je 0x53bdac
mov edx, dword [ebp - 0x14]
mov eax, dword [0x6abb04]
call fcn.0053b3e0
inc edi
dec ebx
jne 0x53bd09
mov eax, dword [0x6abb04]
cmp dword [eax + 8], 0
jle 0x53bdcc
mov eax, dword [0x6abb04]
call fcn.0053b494
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x53bde5
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0053bac8
pop ecx
test al, al
jne 0x53bde5
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret