joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5437fc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x40]
mov ecx, edi
call fcn.00569f97
mov edx, dword [eax]
xor ebx, ebx
push ebx
push 2
push dword [esi + 0x50]
mov ecx, eax
push dword [esi + 0x4c]
call dword [edx + 0x2c8]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne 0x5438bb
cmp dword [ebp + 8], 0x1b
jne 0x5438dd
push ebx
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0x157
push dword [esi + 0x20]
call ebx
test eax, eax
je 0x543862
push 0
push 0
push 0x14f
push dword [esi + 0x20]
call ebx
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x38]
test eax, eax
je 0x5438dd
push dword [esi + 0x50]
mov eax, dword [edi]
mov ecx, edi
push dword [esi + 0x4c]
call dword [eax + 0x20]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x98]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x3c]
mov ecx, edi
call fcn.00569f97
push 1
mov ecx, edi
pop esi
mov dword [eax + 0x498], esi
call fcn.004ed0d2
mov ecx, eax
call sub.MFC42.DLL_CWnd::SetFocus
mov ecx, edi
call fcn.00569f97
and dword [eax + 0x498], 0
mov eax, esi
jmp 0x5438ed
mov ecx, edi
call fcn.00569f97
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x100
push esi
call dword [edx + 0x308]
jmp 0x5438ed
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0054d90b
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x549492
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi - 0x20], 0
jne 0x5494a3
xor eax, eax
jmp 0x549656
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
mov di, ax
mov ebp, 0x8000
push 0x10
and edi, ebp
call ebx
mov bx, ax
and ebx, ebp
xor ebp, ebp
cmp edi, ebp
jne 0x549643
mov eax, dword [esp + 0x14]
sub eax, 0x23
je 0x5495c3
dec eax
je 0x549562
sub eax, 0xa
jne 0x549643
mov ecx, esi
call fcn.00569f97
mov eax, dword [eax + 0x4b0]
cmp dword [eax + 0xa4], ebp
jne 0x549643
cmp ebx, ebp
jne 0x549643
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x13c]
test eax, eax
jne 0x549643
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x48]
test eax, eax
je 0x549643
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
test eax, eax
je 0x549643
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
push 0x69ab30
mov ecx, esi
call dword [eax + 0x74]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x18]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
jmp 0x54960e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
test eax, eax
je 0x549643
mov ecx, esi
call fcn.00526c47
test eax, eax
jne 0x549589
push dword [esi + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [esi + 0xc]
call dword [eax + 0x20]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x10]
mov ecx, dword [esi + 0x38]
push 0xffffffffffffffff
mov edi, dword [ecx]
call dword [edi + 0x30]
mov ecx, dword [esi + 0x38]
push eax
call dword [edi + 0x50]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push eax
push 0xb1
push dword [esi - 0x20]
call edi
push ebp
push ebp
push 0xb7
push dword [esi - 0x20]
call edi
jmp 0x54960e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
test eax, eax
je 0x549643
mov ecx, esi
call fcn.00526c47
test eax, eax
jne 0x5495e6
push dword [esi + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [esi + 0xc]
call dword [eax + 0x20]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x10]
mov ecx, dword [esi + 0x38]
mov edi, dword [ecx]
call dword [edi + 0x4c]
mov ecx, dword [esi + 0x38]
push eax
call dword [edi + 0x38]
cmp eax, 0xffffffff
je 0x54960e
push ebp
push eax
push eax
lea ecx, [esi - 0x40]
call fcn.00549900
lea ecx, [esi - 0x40]
call fcn.0054aade
mov ecx, esi
call fcn.00569f97
mov edx, dword [eax]
push ebp
push 2
mov ecx, eax
push dword [esi + 0x10]
push dword [esi + 0xc]
call dword [edx + 0x2c8]
test eax, eax
jne 0x54963e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x98]
push 1
pop eax
jmp 0x549656
push dword [esp + 0x1c]
mov ecx, esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.0055b002
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x54b001
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, 0x581348
call fcn.00570e3c
sub esp, 0x40
push ebx
push esi
mov esi, ecx
call fcn.00526c47
test eax, eax
je 0x54b11f
xor ebx, ebx
mov ecx, esi
push ebx
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.00569f97
mov ecx, eax
call fcn.004f31ab
test eax, eax
je 0x54b11f
mov eax, dword [esi]
or dword [ebp - 0x14], 0xffffffff
push edi
mov ecx, esi
xor edi, edi
mov dword [ebp - 0x18], ebx
call dword [eax + 0x14]
test eax, eax
je 0x54b055
lea eax, [ebp - 0x14]
lea ecx, [esi - 0x40]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.005498a8
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
je 0x54b113
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], ebx
dec eax
cmp eax, 0xffffffff
jge 0x54b078
or eax, 0xffffffff
mov ecx, dword [esi + 0x38]
push 1
push eax
lea eax, [ebp - 0x10]
push dword [ebp - 0x18]
mov edx, dword [ecx]
push eax
call dword [edx + 0x1c]
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
je 0x54b107
push 0x1000
push 0x2042
lea ecx, [ebp - 0x4c]
call fcn.00570a52
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
push dword [eax - 8]
push eax
call sub.MFC42.DLL_CMemFile::Write
push 1
push 0x69e838
lea ecx, [ebp - 0x4c]
call sub.MFC42.DLL_CMemFile::Write
lea ecx, [ebp - 0x4c]
call sub.MFC42.DLL_CSharedFile::Detach
mov ecx, esi
mov edi, eax
call fcn.004ed0d2
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
push edi
push dword [0x6a0fb8]
call dword [sym.imp.USER32.dll_SetClipboardData]
xor ecx, ecx
cmp eax, ebx
setne cl
mov edi, ecx
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CSharedFile::CSharedFile
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, esi
call fcn.004ee6d0
or eax, edi
pop edi
jmp 0x54b121
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x54b192
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
mov esi, ecx
push dword [0x6a09cc]
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x54b1bf
mov ecx, esi
call fcn.00569f97
mov eax, dword [eax + 0x4b0]
cmp dword [eax + 0xa4], 0
jne 0x54b27b
mov ecx, esi
call fcn.00526c47
test eax, eax
je 0x54b27b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
test eax, eax
je 0x54b27b
mov eax, dword [esi + 0x14]
test byte [eax + 4], 4
je 0x54b1f0
test byte [eax + 0x18], 4
jne 0x54b27b
push ebx
push ebp
push edi
xor ebp, ebp
call dword [sym.imp.USER32.dll_GetOpenClipboardWindow]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
test eax, eax
jne 0x54b217
mov ecx, esi
call fcn.004ed0d2
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
mov ebp, eax
push dword [0x6a0fb8]
mov ebx, dword [sym.imp.USER32.dll_GetClipboardData]
call ebx
mov edi, eax
test edi, edi
jne 0x54b23d
push 1
call ebx
mov edi, eax
test edi, edi
jne 0x54b248
push 7
call ebx
mov edi, eax
jmp 0x54b244
mov dword [esi + 0x70], 1
test edi, edi
je 0x54b261
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x118]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
and dword [esi + 0x70], 0
test ebp, ebp
je 0x54b26f
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
test edi, edi
pop edi
pop ebp
pop ebx
pop esi
setne al
ret
xor eax, eax
pop esi
ret
Function at 0x5590af
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and dword [ebp - 0x24], 0
push ebx
push esi
mov esi, ecx
push edi
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x24], eax
mov ebx, 0xc8
je 0x559158
xor eax, eax
push 1
push eax
push eax
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x559119
cmp dword [ebp - 0x24], 0x200
je 0x559150
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x559150
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_ScreenToClient]
call edi
sub eax, dword [ebp - 4]
cmp eax, ebx
jbe 0x559150
push dword [ebp - 8]
mov ecx, esi
push dword [ebp - 0xc]
push 0
call fcn.005595b2
cmp ebx, 0x64
jbe 0x559150
sub ebx, 0x14
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp + 8]
jne 0x5590e5
call dword [sym.imp.USER32.dll_ReleaseCapture]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x560b2f
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push dword [0x69a188]
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x560b7d
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x560b7d
push esi
push dword [0x69a188]
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 8]
push eax
call fcn.004ea8a0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 1
pop eax
pop esi
ret
xor eax, eax
ret
Function at 0x56105d
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x5825e4
call fcn.00570e3c
sub esp, 0x38
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_4
lea eax, [ebp - 0x14]
xor edi, edi
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call sub.MFC42.DLL_CWnd::GetWindowTextA
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne 0x56109c
cmp dword [esi + 0x7c], edi
mov dword [ebp - 0x10], edi
je 0x5610a3
mov dword [ebp - 0x10], 1
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
jle 0x56117f
mov eax, dword [ebp - 0x14]
cmp ebx, dword [eax - 8]
jg 0x56117f
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.00560f43
mov edi, dword [ebp - 0x30]
test ebx, ebx
jle 0x561132
push esi
lea ecx, [ebp - 0x44]
call sub.MFC42.DLL_CClientDC::CClientDC
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0050d00a
push eax
lea ecx, [ebp - 0x44]
call sub.MFC42.DLL_CDC::SelectObject
push dword [ebp + 8]
mov ebx, eax
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
push ebx
lea ecx, [ebp - 0x44]
call sub.MFC42.DLL_CDC::SelectObject
add edi, dword [ebp - 0x20]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.004eaedc
mov ebx, dword [ebp + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
je 0x56116d
mov eax, dword [esi + 0xac]
cmp eax, 0xffffffff
je 0x56115a
cmp dword [esi + 0xb0], eax
je 0x56115a
cmp dword [ebp - 0x10], ecx
je 0x561155
push ebx
push eax
jmp 0x561166
push ecx
push 0xffffffffffffffff
jmp 0x561166
cmp dword [ebp - 0x10], ecx
je 0x56116d
push ebx
push dword [esi + 0xa8]
mov ecx, esi
call fcn.00561feb
push dword [ebp - 0x2c]
push edi
call dword [sym.imp.USER32.dll_SetCaretPos]
mov dword [esi + 0xa8], ebx
jmp 0x561193
cmp dword [ebp + 0xc], edi
je 0x561193
cmp dword [ebp - 0x10], edi
jne 0x561193
push edi
push 0xffffffffffffffff
mov ecx, esi
call fcn.00561feb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x562c5f
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x562cd4
cmp byte [edi], 0
je 0x562cd4
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x562cd4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x562cd4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x562cc3
push esi
push dword [0x69a18c]
call dword [sym.imp.USER32.dll_SetClipboardData]
xor esi, esi
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
je 0x562cd9
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop edi
pop esi
ret
push 1
pop eax
jmp 0x562cd6

Function at 0x5631a4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0x79
push esi
mov esi, ecx
jne 0x5631fb
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x563213
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
cdq
sub eax, edx
sar eax, 1
movzx ecx, ax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
shl ecx, 0x10
cdq
sub eax, edx
sar eax, 1
movzx eax, ax
or ecx, eax
push ecx
push 0
push 0x205
push dword [esi + 0x20]
jmp 0x56320d
cmp dword [ebp + 8], 8
jne 0x563213
push 0
push 0
push 0x304
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00563c55
pop esi
leave
ret 0xc

Function at 0x5645ad
Capabilities:
Get geographical location

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x74], 3
jne 0x5645c5
mov ecx, dword [esp + 8]
add esi, 0x78
push esi
call sub.MFC42.DLL_CString::operator_1
jmp 0x564612
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ebx, eax
mov eax, dword [esi + 0x74]
xor edi, edi
sub eax, edi
je 0x5645e7
dec eax
je 0x5645e3
dec eax
jne 0x5645ec
push 0x20
pop edi
jmp 0x5645ec
push 0x1f
jmp 0x5645e0
mov edi, 0x1003
mov ecx, dword [esp + 0x10]
mov eax, 0x100
push eax
push eax
call sub.MFC42.DLL_CString::GetBuffer
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
call sub.MFC42.DLL_CString::ReleaseBuffer
pop edi
pop ebx
pop esi
ret 4
Function at 0x569050
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0055ad38
cmp dword [esi + 0x24], 0
je 0x5690c9
mov eax, dword [esi]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
call dword [eax + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x5690c9
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esi + 0x34]
call ebx
mov ecx, dword [esi + 0x30]
add ecx, edi
cmp eax, ecx
jb 0x5690c9
mov eax, 0x96
cmp edi, eax
jbe 0x5690ad
mov dword [esi + 0x34], eax
jmp 0x5690b8
cmp edi, 0x32
jbe 0x5690b8
add edi, 0xfffffffb
mov dword [esi + 0x34], edi
call ebx
mov ecx, dword [esi + 4]
mov dword [esi + 0x30], eax
push esi
mov eax, dword [ecx]
call dword [eax + 0x124]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x569f9b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x569fb9
cmp dword [0x6a10b8], edi
jne 0x56a11e
cmp word [0x6a10c4], di
push 1
pop ebx
mov dword [0x6a10b8], ebx
jne 0x56a0c1
push str.MSH_SCROLL_LINES_MSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
cmp eax, edi
mov dword [0x6a10c0], eax
jne 0x56a0b8
mov word [0x6a10c4], bx
push 0x94
lea eax, [ebp - 0x9c]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x94
mov dword [0x6a10bc], 3
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x56a11e
cmp dword [ebp - 0x8c], ebx
je 0x56a041
cmp dword [ebp - 0x8c], 2
jne 0x56a11e
cmp dword [ebp - 0x98], 4
jae 0x56a106
lea eax, [ebp + 8]
push eax
push ebx
push edi
push str.Control_PanelDesktop
push OleUIInsertObjectA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x56a11e
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 8]
push eax
push edi
push str.WheelScrollLines
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x56a0ad
push 0xa
lea eax, [ebp - 0x11c]
push edi
push eax
call dword [sym.imp.MSVCRT.dll_strtoul]
add esp, 0xc
mov dword [0x6a10bc], eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x56a11e
mov word [0x6a10c4], 2
cmp word [0x6a10c4], 2
jne 0x569fee
push str.Magellan_MSWHEEL
push str.MouseZ
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
je 0x569fee
mov ecx, dword [0x6a10c0]
cmp ecx, edi
je 0x569fee
push edi
push edi
push ecx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x6a10bc], eax
jmp 0x56a123
cmp dword [ebp - 0x8c], 2
jne 0x56a11e
push edi
push 0x6a10bc
push edi
push 0x68
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [0x6a10bc]
pop edi
pop ebx
leave
ret 4
Function at 0x56c03a
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [esp + 4], 9
push esi
push edi
mov esi, ecx
jne 0x56c087
push 0x59d230
call sub.MFC42.DLL_CObject::IsKindOf
test eax, eax
jne 0x56c087
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
push dword [esi + 0x20]
mov di, ax
shr edi, 0xf
and edi, 1
call dword [sym.imp.USER32.dll_GetParent]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
test eax, eax
je 0x56c0b7
push 0
push edi
push 0x28
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x56c0b7
xor edi, edi
cmp dword [esi + 0xac], edi
jle 0x56c0b0
mov eax, dword [esi + 0xa8]
push dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
call fcn.0056c5c8
test eax, eax
jne 0x56c0bc
inc edi
cmp edi, dword [esi + 0xac]
jl 0x56c091
mov ecx, esi
call sub.MFC42.DLL_CWnd::Default
pop edi
pop esi
ret 0xc
push edi
mov ecx, esi
call fcn.0056b4d9
jmp 0x56c0b7

Function at 0x57096e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
lea eax, [ebp - 0x100]
mov ecx, dword [ebp + 0xc]
push 0x100
push eax
xor eax, eax
cmp dword [ebp + 0x10], eax
setne al
lea eax, [eax + ecx*2]
push dword [eax*4 + str._a_f70123_4_5.6_D8E9F:G_H_IJ_K_L_MANBOC]
push dword [0x6a10fc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x5709ba
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call fcn.004ea8a0
push 1
pop eax
leave
ret 0xc

Function at 0x5709be
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
lea eax, [ebp - 0x100]
mov ecx, dword [ebp + 0xc]
push 0x100
push eax
xor eax, eax
cmp dword [ebp + 0x10], eax
setne al
lea eax, [eax + ecx*2]
push dword [eax*4 + 0x59da10]
push dword [0x6a10fc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x570a0a
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call fcn.004ea8a0
push 1
pop eax
leave
ret 0xc

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401f64
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, word [ebp + 8]
push ebx
push esi
push edi
push 0xa
push eax
push dword [0x40c080]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x401f9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push dword [0x40c080]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
ja 0x401fa6
xor eax, eax
jmp 0x402096
push edi
push dword [0x40c080]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0x40
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push esi
push ebx
push edi
mov dword [ebp - 8], edi
call fcn.00402900
sub esi, 0x20
push 0x20
mov dword [ebp - 0xc], esi
lea eax, [edi + esi]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00402900
add esp, 0x18
xor eax, eax
xor ebx, ebx
movzx ecx, byte [ebp + eax - 0x2c]
add ebx, ecx
inc eax
cmp eax, 0x20
jb 0x401fee
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp ebx, eax
jne 0x402032
test ebx, ebx
je 0x402053
xor edx, edx
xor ecx, ecx
test esi, esi
jbe 0x402053
mov al, dl
and al, 0x23
xor al, byte [edx + edi]
or al, byte [ebp + ecx - 0x2c]
inc ecx
cmp ecx, 0x10
mov byte [edx + edi], al
jne 0x402027
xor ecx, ecx
inc edx
cmp edx, esi
jb 0x402011
test ecx, ecx
jne 0x402009
jmp 0x402053
xor edx, edx
xor ecx, ecx
test esi, esi
jbe 0x402053
mov al, byte [ebp + ecx - 0x2c]
xor al, byte [edx + edi]
xor al, dl
inc ecx
cmp ecx, 0x10
mov byte [edx + edi], al
jne 0x40204e
xor ecx, ecx
inc edx
cmp edx, esi
jb 0x40203a
mov edi, dword [edi]
mov dword [ebp + 8], edi
add edi, 0x100
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, 4
push eax
mov eax, dword [ebp - 8]
add eax, 4
push eax
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00401c26
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4024d3
Capabilities:
Copy file
Create directory
Create service
Persist via run registry key
Query or enumerate registry value

Disassembly:
lea esp, [esp + 4]
cmp dh, 0x4f
mov edi, 0x104
sub ebx, ebx
push edi
movsx eax, ax
lea eax, [ebp - 0x114]
jmp 0x4027cd
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push 0x40911c
jmp 0x402266
push ebx
jmp loc.0040d8d1

Function at 0x402626
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
push 0x409198
jmp loc.0040d304

Function at 0x406cf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x406cf1
lcall 0x5de5, 0x8b10c483
jmp loc.0079a3dc