joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ac690
Capabilities:
Encode data using xor

Disassembly:
and al, 0x38
mov word [esp], bx
lea esp, [esp + 0xc]
jne 0x697d56
call fcn.005f15d1
shl ch, 5
sub ch, 0x14
sbb cx, ax
add esp, 8
not cx
push esp
lea ecx, [esi + 8]
mov dword [esp], eax
call fcn.005f10b0
mov cl, 0xdc
xrelease xchg dword [ebx + 0x74cd5490], edx
cmp cl, byte [ebp + 0x5a]
or byte [ebx + ebp*8 - 0x6e372354], ch
clc
cdq
in al, dx
jns 0x6ac6ec
push ss
cmp bh, byte [eax - 0x20]
cmp al, 0x62
push esi
push es
push esi
fnstcw word [esi + ebx*4 - 0x37e3eede]
pop ebx
jle 0x6ac74d
mov bh, 0xfc
adc cl, byte gs:[ebx - 0x6814b3ef]
add byte [edx + 0x39], ch
push ds
js 0x6ac694
mov edx, dword [ecx]
dec esp
jmp 0x6ac688
jb 0x6ac6d5
add al, 0xdb
inc edi
imul esi, dword [edi + 0x21], 0x38cb6ce1
stosb byte es:[edi], al
idiv dword [ecx]
cmp ebp, dword [esp - 0x45]
pop ss
cmpsd dword [esi], dword es:[edi]
xor esp, ecx
mov ecx, 0x380afdb9
out dx, al
push ebp
cmp al, byte [ecx - 0x3a]
mov al, 0xe5
cmpsb byte [esi], byte es:[edi]
insb byte es:[edi], dx
lodsd eax, dword [esi]
stosb byte es:[edi], al
call 0x922bff54
imul esp, dword [edi - 0x14], 0xffffffd9
push 0x34f0e33f
cmpsd dword [esi], dword es:[edi]
mov ecx, eax
push esi
xchg dword [eax + eax*2 + 0x2d780f01], eax
pop ebx
aas
adc byte [esi + 0x20e99bb1], bl
mov ecx, 0xdd7a67e3
arpl dx, dx
hlt
je 0x6ac7b4
lahf
mov bl, 0x94
not dword [edi]
mov edx, 0xc7633dce
imul ecx, dword [edx + 0x49], 0xdd27e788
cmp al, 0x2d
std
or bh, 0x22
arpl ax, bx
mov dword [0x51f2b3cc], eax
pop ebx
dec ebp
invalid
jmp 0x7acec9
xchg dword [esp + 0x28], eax
push 0xc804ec84
push esp
push dword [esp + 0x30]
ret 0x34

Function at 0x6c9292
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], cl
call fcn.00654ec4

Function at 0x6c929b
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00770e05
pushal
pushfd
pop dword [esp + 0x1c]
stc
clc
xor dword [esp + 0x1c], 0x11
pushfd
xor ecx, 0x23ac6d7
cmc
xor ebp, 0x4989e396
push 0x67fd81bb
test esp, 0xdeffd702
xor eax, 0xf6e7522a
pushal
xor ebx, 0xc20faf1d
cmp dx, cx
jmp 0x6c52cc
xor edi, 0x98a255c4
clc
clc
xor esi, 0x5dc34df3
mov dword [esp], 0xdcfc18e6
xor edx, 0x506d4238
mov byte [esp + 4], 0x6c
push dword [esp + 0x44]
popfd
pushfd
push dword [esp + 0x4c]
ret 0x50
pushfd
stc
bt dx, 8
cmp edi, ebx
jmp 0x7183c7
lea esp, [esp + 8]
je 0x7acce6
not al
bswap ax
mov dword [edi], 0x423fc4
movzx ax, cl
lahf
bswap ax
movsx eax, bl
lea eax, [ebp - 0x24]
push 0x78f97d1
jmp 0x65dec3
Function at 0x78e196
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + 0x14], esi
jmp 0x6c2dff
pushal
xchg dword [esp + 0x30], esi
movsx esi, cl
movzx si, al
mov esi, 0x4010d2
jmp 0x6688d9
call fcn.006cfdff
or dword [ecx], 0x2e
and eax, 0xd15485bb
rcl ebp, 1
jo 0x75af04
inc esp
push ecx
and al, 0x95
or dword [ebp + 0x2185d9ba], ebx
push ecx
dec ecx
pop es
popfd
test eax, 0x58d785fb
and esi, dword [ebx + edx*2]
bound esp, qword [ebx - 0x76578698]
xor bl, ch
mov esi, 0x1dfdc80d
shr byte [edx + 0x4a1da64b], 0x33
out 0x93, al
or eax, 0xc01dfdc8
stosb byte es:[edi], al
dec ebx
cmpsb byte [esi], byte es:[edi]
sbb eax, 0x93e6334a
push ebp
arpl word [ecx], si
leave
scasb al, byte es:[edi]
lahf
xchg edi, eax
pop ds
daa
jne 0x75af69
sbb ch, cl
dec eax
push esp
in al, dx
out dx, al
pop ds
mov edi, dword [edx]
sub byte [edx + edi + 0x2e58610c], bh
invalid
mov bl, 0x74
loopne 0x75afdc
dec esp
xor ebx, dword [ebp + 0x4b]
inc esi
dec eax
push es
mov cl, 0x2e
xchg esi, eax
bsf eax, dword [esi]
and byte [esi], ah
movsb byte es:[edi], byte [esi]
out 0x53, al
xor eax, 0xcf733908
push ebx
fmul st(0)
imul edx, ecx, 0xffffffef
xor ecx, dword [eax + ebp*4 + 0x4c]
or byte [0xeb72a4df], ah
movsd dword es:[edi], dword [esi]
cli
jecxz 0x75afca
adc eax, eax
pop es
push esi
pushfd
inc ebx
cmp al, 0x2d
xchg edx, eax
xchg byte [eax + esi*2], dl
aam 0x84
movsd dword es:[edi], dword [esi]
clc
div byte [ebx]
mov esi, 0xe298f1f
rol dword [ecx], cl
inc ebp
pop edx
out 0xe9, eax
popal
int3
salc
adc eax, 0x10
jne 0x75b03c
or ah, bh
adc dword [0xaa3e8cd3], 0x3e
rol byte es:[ecx], 1
mov ebx, 0x8159ce3d
call 0x10b1276c
dec ebp
sbb eax, 0xa2cb867a
call dword [eax + edx*8]
in al, dx
mov edx, 0xaeff61fc
inc ebx
sbb byte [eax], ah
out dx, al
scasb al, byte es:[edi]
popfd
add ah, cl
popal
xchg edx, eax
int 0x4f
xor eax, 0x7819f2a7
js 0x75b071
js 0x75b045
js 0x75b071
retf
mov ebx, 0x6a76f7fc
pop ebp
dec edx
ror ah, cl
ficomp dword [esi]
jnp 0x75b039
cdq
inc eax
loop 0x75b0a8
and byte [edx - 0x7a5a9aaf], cl
push esp
adc dword [eax + eax*8 - 0x6d], esi
clc
lahf
not byte [edi + 0x522682f8]
xchg edi, eax
clc
and byte [esi], 0x52
push edx
cld
mov dh, 0xbd
ficom word [edx - 0x4c13c600]
jo 0x75b089
sbb eax, dword [ebp + 0x20603789]
loopne 0x75b01d
jno 0x75b005
lodsb al, byte [esi]
mov word [edi - 0x7b4b4419], es
add eax, 0xe68b094c
push ebp
ja 0x75b0d3
cld
cdq
test eax, 0xa0138ef7
mov esi, 0x116f589
and al, 0xfe
add dword [esi + edi*8], esp
mov edx, 0xb75dcd6a
mov ecx, 0x376d2adc
jno 0x75b0fb
aas
dec ebx
cmp ah, ch
stosd dword es:[edi], eax
dec eax
pop edi
and al, cl
mov byte [edx - 0x2dff015], dh
invalid
insd dword es:[edi], dx
pop ebx
or byte [eax + 0x58], 0xb0
invalid
sbb eax, 0xc9ab4703
invalid
mov bl, 0x5f
mov dword [esp], 0xb5bdc7cb
call fcn.007946b5
movzx si, bl
mov si, word [esp]
mov esi, dword [esp + 0xc]
mov dword [esp], 0x1010d7e7
pushfd
jmp 0x6a69c7
lea esp, [esp + 8]
jne 0x64c134
push 0x1d47117d
mov dword [esp], esi
pushfd
mov dword [esp], edi
jmp 0x75aed4
Function at 0x7a0f9c
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
mov dword [ebp - 4], ebx
push edx
test edx, edx
pushal
pushal
jmp 0x6be01c
cmp bl, 0x93
mov dword [ebp - 8], esi
stc
test bl, al
sub esp, 0xffffffd4
jno 0x6589b4
mov dword [ebp - 4], ebx
pushal
jmp 0x797397
Function at 0x402a54
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040404c
test esi, esi
jne 0x402a8a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040413c
jmp 0x402aa8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402908
mov edi, eax
test esi, esi
je 0x402aa8
cmp dword [ebx], 0
je 0x402aa8
dec esi
jmp 0x402a91
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402d1c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x471008], 0x8088405
inc edx
mov dword [ebx + 0x471008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403174
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x471024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40320c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4031ec
xor eax, eax
push ebp
push 0x4031e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403228
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4031ec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x471024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x471024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403ed0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x473048], 0
je 0x403f31
cmp word [0x47321c], 0xd7b2
jne 0x403ef9
cmp dword [0x473224], 0
jbe 0x403ef9
mov eax, 0x473218
call dword [0x473234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x471070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403f58
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x471034], 0
jne 0x403f4d
push 0
push 0x471068
push 0x471070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4052dc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40550c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40535f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40550c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40535f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405528
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4053e8
xor eax, eax
push ebp
push 0x4053e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405124
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4053c6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405548
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4053c6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4053e8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405502
cmp byte [ebp - 0xd], 0
jne 0x40542f
cmp byte [ebp - 0x12], 0
je 0x405502
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405448
dec ebx
cmp byte [ebx], 0x2e
je 0x405457
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405447
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405502
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405494
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405502
cmp byte [ebp - 0xd], 0
je 0x405502
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405502
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405c08
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405c6e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004042bc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402d38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405c58
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405c75
lea eax, [ebp - 0x10]
call fcn.0040404c
ret

Function at 0x40b060
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b099
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040413c
jmp 0x40b0a2
mov eax, ebx
mov edx, esi
call fcn.004040a0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b0ac
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b0cd
mov al, byte [esp]
jmp 0x40b0cf
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b754
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b5cc
mov eax, dword [0x4727f8]
cmp byte [eax], 0
je 0x40b7d0
mov eax, dword [0x4725ec]
call fcn.00402b88
call fcn.00402834
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004088c0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b818
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b806
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x472594]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x473664]
call fcn.004050e8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c06c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c142
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004040e4
lea eax, [ebp - 8]
call fcn.0040455c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040450c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c12c
mov eax, ebx
call fcn.004026cc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c125
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040450c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c10f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c154
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c10f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c12c
mov eax, dword [ebp - 0x10]
call fcn.004026ec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c149
lea eax, [ebp - 8]
call fcn.0040404c
ret

Function at 0x40c6c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c728
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004042bc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004082ac
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c72f
lea eax, [ebp - 0xc]
call fcn.0040404c
ret

Function at 0x41a8a8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x473884
cmp dword [edi], 0
jne 0x41a924
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x473880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4713f0
mov ecx, 2
call fcn.004028c8
mov edx, 0x41a880
lea eax, [esi + 5]
call fcn.0041a8a0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a8a0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a8f9
mov dword [0x473880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41bea8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41beae
ret
Function at 0x41e514
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41e565
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41e54c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41e53c
jmp 0x41e565
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41e54d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42da90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0042d67c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040450c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x42daee
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x472718]
mov dl, 1
mov eax, dword [0x42d574]
call fcn.0040b914
call fcn.00403a88
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42daf8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040450c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x42db50
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x472910]
mov dl, 1
mov eax, dword [0x42d574]
call fcn.0040b914
call fcn.00403a88
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042d6ac
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4354ac
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x4353f8
call sub.user32.dll_EnumWindows
ret

Function at 0x4355cc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x435649
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0043502c
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x3e8
jbe 0x4355f1
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00434c2c
cmp dword [ebp - 4], 0
je 0x435633
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.0040450c
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435650
lea eax, [ebp - 4]
call fcn.0040404c
ret
Function at 0x438970
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x473b54], 0
je 0x438abf
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x472794]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x438abf
mov eax, dword [0x473b58]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x473b54]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x438a8e
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x473b54]
call fcn.00413e60
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x438a86
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x438a86
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x438a86
mov eax, dword [ebp - 0x14]
call fcn.00441608
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x438a86
push ebp
call fcn.0043892c
pop ecx
test al, al
jne 0x438a86
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x438a42
mov eax, dword [ebp - 0x14]
call fcn.00440138
dec eax
jle 0x438a86
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004034f8
cmp byte [ebp - 1], 0
je 0x438a86
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x438a86
mov edx, dword [ebp - 0x14]
mov eax, dword [0x473b58]
call fcn.004380f8
inc edi
dec ebx
jne 0x4389d5
mov eax, dword [0x473b58]
cmp dword [eax + 8], 0
jle 0x438aa6
mov eax, dword [0x473b58]
call fcn.00438188
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x438abf
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00438794
pop ecx
test al, al
jne 0x438abf
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret