joyce8/EMBER2024-capa huggingface dataset:
Function at 0xee8d98
Capabilities:
Encode data using xor

Disassembly:
jmp 0xee8da2
pushal
call 0xee8da8
pop ebp
sub ebp, 0x10
sub ebp, 0xae8d98
jmp 0xee8dbe
add byte [edx], cl
sub bh, byte [edx]
mov eax, 0xae8d98
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ea
mov edx, 0x6b8af818
xor byte [eax], dl
inc eax
dec ecx
jne 0xee8dd5
jmp 0xee8de8
xchg ebx, eax
aad 0x93
xchg ecx, eax
and al, 0x18
sbb byte [eax], bl
cdq
fchs
sbb byte [eax], bl
sbb byte [ebx], bl
aad 0xa0
push ds
sbb byte [eax], bl
sbb byte [edx + 0x18181830], ah
out dx, eax
cli
sbb edx, eax
xchg ebx, eax
cdq
adc al, 0x18
sbb byte [eax], bl
sbb ebx, ebp
xchg ebp, eax
jl 0xee8e4d
in al, 0x91
sbb al, 0x3c
xchg ebp, eax
jl 0xee8e54
in al, 0x91
sbb al, 0x3c
jo 0xee8e1a
mov edi, dword [ecx]
sbb byte [eax - 0x56], dh
loope 0xee8db9
sbb byte [ecx], bl
xor al, 0x3c
jo 0xee8eaa
loope 0xee8e8c
xchg esi, eax
invalid
fyl2x
sbb ch, byte [ecx]
sbb bl, byte [ebx + 0x17511cda]
sbb al, 0x51
pop ss
popfd
in al, dx
out 0xe7, eax
out 0x93, eax
xor al, 0x3c
xchg ebp, eax
jl 0xee8e9e
sbb al, 0xda
adc al, 0x18
xchg ebx, eax
xchg esp, eax
cmp al, 0x1c
sbb byte [eax], bl
sbb byte [eax - 4], dh
mov edi, dword [ecx]
sbb byte [eax - 0x56], dh
loope 0xee8e0a
sbb byte [ecx], bl
xor al, 0x3c
dec ecx
invalid
sbb byte [eax], bl
int1
inc ecx
sbb bl, byte [eax]
sbb byte [ebp - 0x6e1bc384], dl
xor al, 0x3c
xchg ebp, eax
je 0xee8ecb
sbb bh, ah
insd dword es:[edi], dx
adc al, 0xe7
insd dword es:[edi], dx
adc al, dh
pushfd
sbb byte [eax], bl
sbb byte [ebx + 0x181810a5], dl
sbb byte [eax], bl
sbb byte [ecx - 0x297d0217], bl
mov byte [0x82fde999], al
salc
mov byte [0xea99d12b], al
arpl word [edi + edi + 0x63ea993b], cx
invalid
adc dh, 0xa2
sub edx, ecx
cdq
ljmp 0xea99
sbb byte [eax], bl
sbb byte [edi], dl
nop
push eax
sbb byte [eax], bl
sbb byte [esi - 0x6d], bh
sbb byte [eax], bl
jle 0xee8e62
xchg ebx, eax
add al, 0x21
cwde
jecxz 0xee8ec4
pop ss
pushfd
add bl, byte [eax]
sbb byte [eax], bl
cwde
jecxz 0xee8ece
pop ss
pushfd
or dword [eax], ebx
sbb byte [eax], bl
jle 0xee8e7e
jecxz 0xee8ece
cmp eax, 0x180d9c17
sbb byte [eax], bl
pop ecx
int1
aam 0xe7
out 0xe7, eax
xor dword [ecx + 0x19], edx
wait
fstp dword [0xf11cf09b]
movsd dword es:[edi], dword [esi]
out 0xe7, eax
out 0x31, eax
dec esp
and dword [edx], ebx
wait
fstp dword [esi]
wait
sbb al, 0x9b
invalid
Function at 0x40a588
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x40a60b
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x40a5e6
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call sym.CommTest.exe__Spcomm_TReadThread_HandleReadData_qqrpcui
test al, al
je 0x40a60b
jmp 0x40a59b
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3e5
jne 0x40a5fd
mov byte [ebp - 0xd], 1
jmp 0x40a60b
cmp dword [ebp - 0x14], 6
je 0x40a60b
mov eax, dword [ebp - 4]
call sym.CommTest.exe__Spcomm_TReadThread_PostHangupCall_qqrv
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 8
Function at 0x40aac4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
add eax, edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x40abac
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 6
je 0x40abc6
cmp dword [ebp - 0x14], 0x3e5
je 0x40ab44
mov eax, dword [ebp - 4]
call sym.CommTest.exe__Spcomm_TWriteThread_PostHangupCall_qqrv
jmp 0x40abc6
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28]
push eax
push 2
call sub.KERNEL32.DLL_WaitForMultipleObjects
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
sub eax, 0xffffffff
je 0x40ab98
dec eax
je 0x40abc6
dec eax
je 0x40ab66
jmp 0x40aba2
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.KERNEL32.DLL_GetOverlappedResult
test eax, eax
jne 0x40abac
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 6
je 0x40abc6
mov eax, dword [ebp - 4]
call sym.CommTest.exe__Spcomm_TWriteThread_PostHangupCall_qqrv
jmp 0x40abc6
mov eax, dword [ebp - 4]
call sym.CommTest.exe__Spcomm_TWriteThread_PostHangupCall_qqrv
jmp 0x40abc6
mov eax, dword [ebp - 4]
call sym.CommTest.exe__Spcomm_TWriteThread_PostHangupCall_qqrv
jmp 0x40abc6
mov eax, dword [ebp - 0x18]
sub dword [ebp + 8], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x1c], eax
cmp dword [ebp + 8], 0
ja 0x40aaf3
mov byte [ebp - 0xd], 1
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 4

Function at 0x41c54c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041c3a4
dec esi
jne 0x41c56e
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x41d698
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4bdbc4
cmp dword [edi], 0
jne 0x41d714
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x4bdbc0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4b862c
mov ecx, 2
call fcn.00432880
mov edx, 0x41d670
lea eax, [esi + 5]
call fcn.0041d690
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041d690
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41d6e9
mov dword [0x4bdbc0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41ead0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00432ee8
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x4bd6b4]
cmp byte [edx + 0xc], 0
je 0x41eb34
mov edx, dword [0x4bd6ac]
cmp dword [edx], 2
jne 0x41eb34
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret

Function at 0x41eb38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x41ebf0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0041ead0
test al, al
je 0x41ebd2
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.0043444c
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x41ebd2
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0043480c
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.ADVAPI32.DLL_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.0043480c
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0043454c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x41eb8b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ebf7
lea eax, [ebp - 0x2c]
call fcn.0043435c
lea eax, [ebp - 0xc]
call fcn.0043435c
ret
Function at 0x41ecf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0043480c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x41ed48
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4bd674]
mov dl, 1
mov eax, dword [0x41e778]
call fcn.00424f14
call fcn.00433df8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0041e880
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x424664
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x42469d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0043444c
jmp 0x4246a6
mov eax, ebx
mov edx, esi
call fcn.004343b0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4246b0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4246d1
mov al, byte [esp]
jmp 0x4246d3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x424d58
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x424bd0
mov eax, dword [0x4bd874]
cmp byte [eax], 0
je 0x424dc5
mov eax, dword [0x4bd87c]
call fcn.00432d68
call fcn.004327ec
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00421d48
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x424e0c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x424dfb
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4bd720]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4bdaac]
call fcn.00435ae8
push eax
call sub.USER32.DLL_LoadStringA
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.USER32.DLL_MessageBoxA
add esp, 0x444
ret
Function at 0x425bf4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x425c58
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004345c4
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00421874
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425c5f
lea eax, [ebp - 0xc]
call fcn.0043435c
ret

Function at 0x4329ac
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0043435c
test esi, esi
jne 0x4329e2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0043444c
jmp 0x432a00
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004328c0
mov edi, eax
test esi, esi
je 0x432a00
cmp dword [ebx], 0
je 0x432a00
dec esi
jmp 0x4329e9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x43349c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4b8b9c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x433534
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x433514
xor eax, eax
push ebp
push 0x43350d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x433550
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433514
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x4b8b9c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4b8b9c], ax
mov esp, ebp
pop ebp
ret

Function at 0x43415c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4bdf5c], 0
je 0x4341bd
cmp word [0x4be130], 0xd7b2
jne 0x434185
cmp dword [0x4be138], 0
jbe 0x434185
mov eax, 0x4be12c
call dword [0x4be148]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4341e4
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x4b8bac], 0
jne 0x4341d9
push 0
push 0x4b8c04
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x434310
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0043261c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4bdf5d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4342d8
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x435cdc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x435f0c
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x435d5f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x435f0c
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x435d5f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x435f28
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x435de8
xor eax, eax
push ebp
push 0x435de1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00435b24
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x435dc6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x435f48
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x435dc6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435de8
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x435f02
cmp byte [ebp - 0xd], 0
jne 0x435e2f
cmp byte [ebp - 0x12], 0
je 0x435f02
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x435e48
dec ebx
cmp byte [ebx], 0x2e
je 0x435e57
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x435e47
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x435f02
inc ebx
cmp byte [ebp - 0x12], 0
je 0x435e94
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x435f02
cmp byte [ebp - 0xd], 0
je 0x435f02
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x435f02
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436680
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x4be4d0], 1
jae 0x436706
mov byte [0x4b8b98], 2
mov dword [0x4bdf20], 0x4b4674
mov dword [0x4bdf24], 0x4b468c
mov byte [0x4bdf5e], 2
mov dword [0x4bdf0c], 0x43530c
call fcn.0043346c
test al, al
je 0x4366c3
call fcn.0043349c
call fcn.00433560
mov word [0x4bdf64], 0xd7b0
mov word [0x4be130], 0xd7b0
mov word [0x4be2fc], 0xd7b0
call fcn.004351dc
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x4bdf50], eax
call fcn.004312b8
mov dword [0x4bdf4c], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x4bdf44], eax
ret

Function at 0x43711c
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x437068
call sub.USER32.DLL_EnumWindows
ret

Function at 0x437240
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4372bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00436c8c
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
push 0
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x437265
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004368e4
cmp dword [ebp - 4], 0
je 0x4372a7
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.0043480c
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.USER32.DLL_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4372c4
lea eax, [ebp - 4]
call fcn.0043435c
ret

Function at 0x44b098
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0043435c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x44b0e7
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.004345c4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45322c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x453232
ret

Function at 0x455894
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4558e5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4558cc
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4558bc
jmp 0x4558e5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4558cd
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45eddc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45ee2c]
test si, 4
je 0x45edf0
or bl, 1
test si, 8
je 0x45edfa
or bl, 4
test si, 1
je 0x45ee04
or bl, 8
test si, 2
je 0x45ee0e
or bl, 0x10
test si, 0x10
je 0x45ee18
or bl, 0x20
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x45ee27
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45ee30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45ee68]
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x45ee49
or bl, 1
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x45ee58
or bl, 4
test esi, 0x20000000
je 0x45ee63
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4657a4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4657b6
add esp, 0xfffffff0
call fcn.00433990
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041c614
mov eax, dword [0x4bd8ac]
mov dword [eax + 4], ebx
mov dword [eax], 0x465b48
mov eax, dword [0x4bd8b0]
mov dword [eax + 4], ebx
mov dword [eax], 0x465b54
mov eax, ebx
call fcn.00465b60
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411a88]
call fcn.004335fc
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411a88]
call fcn.004335fc
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411a88]
call fcn.004335fc
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411a88]
call fcn.004335fc
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411a88]
call fcn.004335fc
mov dword [ebx + 0x7c], eax
push 0
call sub.USER32.DLL_GetDC
mov esi, eax
push 0x5a
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.USER32.DLL_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x462028
push eax
push 0
push 0
mov eax, dword [0x4bda3c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x452638]
call fcn.00453d74
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x452638]
call fcn.00453d74
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x452638]
call fcn.00453d74
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00465fc8
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x465ea4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x465ea4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x465ea4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4658f3
call fcn.004339e8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret