joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b4e0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x418d08
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 8], 0
jmp 0x40b503
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x200
jae 0x40b529
push 0
call fcn.0040d6c0
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx*4 + 0x4176d0]
push edx
call fcn.0040b0c0
add esp, 0xc
jmp 0x40b4fa
push 0
push 0
push 3
push 0
push 0
push accept
push 0x418af0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40b612
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40b608
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40b5fe
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
jmp 0x40b5bd
mov eax, dword [ebp - 0x18]
add eax, 8
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x14]
jae 0x40b5f4
cmp dword [ebp - 0x1c], 0x200
jae 0x40b5f4
push 0
call fcn.0040d6c0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
sub eax, dword [edx + ecx*8 + 4]
push eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + eax*8]
push edx
call fcn.0040b0c0
add esp, 0xc
jmp 0x40b5ab
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0040ad80
push 0
push 0
push 0
push 0x40b640
push 0
mov eax, dword [0x41952c]
push eax
call fcn.0040d380
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x40f2ed
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x40f31e
mov eax, dword fs:[4]
mov dword [ebp + 8], eax
mov eax, dword fs:[8]
mov dword [ebp - 4], eax
cmp ebx, dword [ebp - 4]
jb 0x40f325
cmp ebx, dword [ebp + 8]
jae 0x40f325
xor eax, eax
jmp 0x40f50b
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x40f336
xor eax, eax
inc eax
jmp 0x40f50a
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40f348
cmp ecx, edx
jae 0x40f3ac
cmp dword [eax + 4], 0
je 0x40f351
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40f33d
cmp dword [ebp + 8], 0
je 0x40f36b
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x40f3ac
cmp eax, esi
jae 0x40f3ac
mov ecx, dword [0x419550]
mov esi, ebx
and esi, 0xfffff000
xor eax, eax
test ecx, ecx
jle 0x40f38d
cmp dword [eax*4 + 0x419558], esi
je 0x40f3b3
inc eax
cmp eax, ecx
jl 0x40f37f
lea eax, [ebp + 8]
push eax
push 0x1c
lea eax, [ebp - 0x20]
push eax
push 0
push ebx
or edi, 0xffffffff
push edi
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
jl 0x40f423
mov eax, dword [ebp + 8]
jmp 0x40f425
xor eax, eax
jmp 0x40f50a
test eax, eax
jle 0x40f32e
xor edx, edx
mov ebx, 0x419598
inc edx
mov edi, ebx
xchg dword [edi], edx
test edx, edx
jne 0x40f32e
cmp dword [eax*4 + 0x419558], esi
je 0x40f402
lea eax, [ecx - 1]
test eax, eax
jl 0x40f3ef
cmp dword [eax*4 + 0x419558], esi
je 0x40f3eb
dec eax
jns 0x40f3df
test eax, eax
jge 0x40f400
cmp ecx, 0x10
jge 0x40f3fb
inc ecx
mov dword [0x419550], ecx
lea eax, [ecx - 1]
jmp 0x40f402
je 0x40f41a
xor edx, edx
test eax, eax
jl 0x40f41a
lea ecx, [edx*4 + 0x419558]
mov edi, dword [ecx]
inc edx
cmp edx, eax
mov dword [ecx], esi
mov esi, edi
jle 0x40f408
xor eax, eax
xchg dword [ebx], eax
jmp 0x40f32e
xor eax, eax
test eax, eax
je 0x40f508
cmp dword [ebp - 8], 0x1000000
jne 0x40f508
test byte [ebp - 0xc], 0xcc
je 0x40f49a
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x40f508
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40f508
cmp word [eax + 0x18], 0x10b
jne 0x40f508
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x40f508
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x40f49a
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x40f49a
test byte [ecx + 0x27], 0x80
jne 0x40f3ac
xor eax, eax
inc eax
mov ecx, eax
mov edx, 0x419598
xchg dword [edx], ecx
test ecx, ecx
jne 0x40f50a
mov ecx, dword [0x419550]
test ecx, ecx
mov edx, ecx
jle 0x40f4c9
lea eax, [ecx*4 + 0x419554]
cmp dword [eax], esi
je 0x40f4c9
dec edx
sub eax, 4
test edx, edx
jg 0x40f4bd
test edx, edx
jne 0x40f4fa
push 0xf
pop ebx
cmp ecx, ebx
jg 0x40f4d6
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x40f4ee
lea eax, [edx*4 + 0x419558]
mov edi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], esi
mov esi, edi
jle 0x40f4dc
cmp ecx, 0x10
jge 0x40f4fa
inc ecx
mov dword [0x419550], ecx
xor eax, eax
mov ecx, 0x419598
xchg dword [ecx], eax
jmp 0x40f32e
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a376
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40a3ba
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40a389
jmp 0x40a3ba
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40a3aa
pop esi
pop ebp
ret

Function at 0x40b154
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40b189
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40b1b3
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40b1b3
test edi, edi
je 0x40b180
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40b180
test edi, edi
je 0x40b1bb
mov eax, edi
jmp 0x40b182
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40b182
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040e5df
add esp, 0xc
int3
Function at 0x40e613
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestSplayTree.exe_gMozillaPoisonSize], eax
call fcn.0040b154
pop ecx
mov ecx, dword [sym.TestSplayTree.exe_gMozillaPoisonSize]
mov dword [sym.TestSplayTree.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40e64b
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestSplayTree.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4035ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x4035fc
pop dword [ebp - 4]
mov eax, 0xb98f49ff
add eax, 0x46b0ebfd
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x7da07b86
sub dword [ebp - 0x14], 0x2f4e363b
mov dword [ebp - 0x10], 0xeef883d9
sub dword [ebp - 0x10], 0xbcc53794
mov dword [ebp - 0xc], 0x9e984695
sub dword [ebp - 0xc], 0x524c0267
mov dword [ebp - 8], 0x9aaa15ee
sub dword [ebp - 8], 0x9aaa15ee
lea eax, [ebp - 0x14]
push eax
mov eax, 0x90b4876a
add eax, 0x6f8be8b2
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xebcd75ef
sub dword [ebp - 0x14], 0x775b0c99
mov dword [ebp - 0x10], 0x92031650
sub dword [ebp - 0x10], 0x5096b4db
mov dword [ebp - 0xc], 0xea615a29
sub dword [ebp - 0xc], 0x86f1edbd
mov dword [ebp - 8], 0xdb2168ca
add dword [ebp - 8], 0x24de9736
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3a8f5
push 0
call eax
mov ecx, 0x7a5bdeae
add ecx, 0x85a474cf
xor edi, edi
add edi, eax
mov ebx, 0x40c800
add ebx, dword [ebp - 4]
mov edx, 0x3a80b2de
mov esi, dword [ebx]
xor esi, edx
mov dword [edi], esi
add edi, 4
add ebx, 0xa76346d8
add ebx, 0x589cb92c
loop 0x40370f
add eax, 0x6c4c0d40
sub eax, 0x6c4acc79
xor ebx, ebx
add ebx, eax
add eax, 0xfaa48bd3
add eax, 0x55b7432
mov ecx, 0x400000
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004035ed
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.004035ed
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x10008ec6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10008f28
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x10008f38
push 0xd
pop eax
jmp 0x10008f6e
push ebp
push esi
push edi
xor esi, esi
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008f44
sub ecx, ebp
lea eax, [ecx + 1]
add edi, eax
add esi, eax
cmp eax, 1
jne 0x10008f3f
push esi
push edx
push 7
push 0
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x1000c3fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000c40a
pop dword [ebp - 0x3c]
mov eax, 0x4ef915d4
sub eax, 0x3ef851ca
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x36d24
push 0
mov eax, 0xdcb62aec
add eax, 0x334aa61c
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x630dec4a
add ecx, 0x9cf25941
xor esi, esi
add esi, eax
mov edx, 0xd346466a
add edx, 0x3cbbcd96
add edx, dword [ebp - 0x3c]
mov edi, 0x9f2d92d
xor dword [ebp - 0x20], 0xf26705ed
mov ebx, dword [edx]
add dword [ebp - 0x2c], 0x26d4dc7c
xor ebx, edi
sub dword [ebp - 0x18], esi
mov dword [esi], ebx
add dword [ebp - 0x10], 0x4c16d79a
add esi, 0xca863951
add esi, 0x3579c6b3
add edx, 0xa8cbc63f
add edx, 0x573439c5
loop 0x1000c465
add eax, 0xe93b93f4
sub eax, 0xe93a8af5
mov ebx, eax
add eax, 0xb332ea47
add eax, 0x4ccd15be
mov ecx, 0xa28fa2c4
add ecx, 0x6d705d3c
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x405968
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4059ce
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404080
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b14
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4059b8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4059d5
lea eax, [ebp - 0x10]
call fcn.00403e10
ret

Function at 0x40aa48
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aa81
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f00
jmp 0x40aa8a
mov eax, ebx
mov edx, esi
call fcn.00403e64
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40aa94
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aab5
mov al, byte [esp]
jmp 0x40aab7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b13c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40afb4
mov eax, dword [0x45309c]
cmp byte [eax], 0
je 0x40b1b8
mov eax, dword [0x452ec0]
call fcn.00402980
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004082bc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b200
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b1ee
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x452e70]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x454664]
call fcn.00404e7c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40ba54
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bb2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403ea8
lea eax, [ebp - 8]
call fcn.00404320
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004042d0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40bb14
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40bb0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004042d0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40baf7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40bb3c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40baf7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bb14
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bb31
lea eax, [ebp - 8]
call fcn.00403e10
ret

Function at 0x40bfa8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c00c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404080
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407e4c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c013
lea eax, [ebp - 0xc]
call fcn.00403e10
ret

Function at 0x41a184
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x454884
cmp dword [edi], 0
jne 0x41a200
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x454880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4523ec
mov ecx, 2
call fcn.004028b8
mov edx, 0x41a15c
lea eax, [esi + 5]
call fcn.0041a17c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a17c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a1d5
mov dword [0x454880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41b41c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41b422
ret
Function at 0x42a994
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x42a8e0
call sub.user32.dll_EnumWindows
ret

Function at 0x42aab4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x42ab31
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0042a514
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x42aad9
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0042a114
cmp dword [ebp - 4], 0
je 0x42ab1b
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004042d0
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ab38
lea eax, [ebp - 4]
call fcn.00403e10
ret

Function at 0x42dafc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x454b54], 0
je 0x42dc4b
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x45303c]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x42dc4b
mov eax, dword [0x454b58]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x454b54]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x42dc1a
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x454b54]
call fcn.00413704
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x42dc12
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x42dc12
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x42dc12
mov eax, dword [ebp - 0x14]
call fcn.00436794
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42dc12
push ebp
call fcn.0042dab8
pop ecx
test al, al
jne 0x42dc12
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x42dbce
mov eax, dword [ebp - 0x14]
call fcn.004352c4
dec eax
jle 0x42dc12
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004032d4
cmp byte [ebp - 1], 0
je 0x42dc12
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x42dc12
mov edx, dword [ebp - 0x14]
mov eax, dword [0x454b58]
call fcn.0042d284
inc edi
dec ebx
jne 0x42db61
mov eax, dword [0x454b58]
cmp dword [eax + 8], 0
jle 0x42dc32
mov eax, dword [0x454b58]
call fcn.0042d314
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42dc4b
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0042d920
pop ecx
test al, al
jne 0x42dc4b
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43122c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x431278
mov eax, esi
call fcn.004469dc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x431278
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x431278
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x4313b7
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x4312b8
cmp eax, 0x108
ja 0x4312b8
mov eax, esi
call fcn.004469dc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4313ae
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x4313b7
jmp 0x4313ae
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x431397
cmp eax, 0x20a
ja 0x431397
test byte [esi + 0x50], 0x80
jne 0x4312ea
sub eax, 0x203
je 0x4312e7
sub eax, 3
je 0x4312e7
sub eax, 3
jne 0x4312ea
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x4312fe
dec eax
je 0x431313
dec eax
je 0x431330
dec eax
je 0x431313
jmp 0x431337
mov ecx, ebx
mov eax, dword [0x45303c]
mov eax, dword [eax]
mov edx, esi
call fcn.00450188
jmp 0x4313ae
cmp byte [esi + 0x5d], 1
jne 0x431329
mov eax, esi
mov si, 0xffed
call fcn.004032d4
jmp 0x4313b7
or word [esi + 0x54], 1
jmp 0x4313ae
and word [esi + 0x54], 0xfffe
jmp 0x4313ae
mov eax, dword [0x454b10]
cmp byte [eax + 0x20], 0
je 0x4313ae
mov eax, dword [0x454b10]
cmp dword [eax + 0x1c], 0
je 0x4313ae
mov eax, dword [ebx]
mov edx, dword [0x454b10]
cmp eax, dword [edx + 0x1c]
jne 0x4313ae
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00446920
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.004032d4
jmp 0x4313b7
cmp eax, 0xb00b
jne 0x4313ae
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0042fb4c
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret