joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100047d7
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga
Inspect section memory permissions

Disassembly:
mov al, 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.1000455e
cmp eax, 0x8df107ef
inc ebp
test al, 0x50
call fcn.1000456e
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.10004523
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1000484c
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1000455e
rol byte [0x458dc5c4], 0xc0
push eax
call fcn.1000456e
push eax
push esi
push dword [ebp + 8]
call fcn.10004523
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.1000455e
mov word [esi], es
insd dword es:[edi], dx
inc esp
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1000456e
push eax

Function at 0x1000490c
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga
Inspect section memory permissions

Disassembly:
push esi
push dword [ebp + 8]
call fcn.10004523
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
xchg esp, eax

Function at 0x1000491e
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga
Inspect section memory permissions

Disassembly:
xchg esp, eax
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl

Function at 0x10004931
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga
Inspect section memory permissions

Disassembly:
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
Function at 0x10004961
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga
Inspect section memory permissions

Disassembly:
mov byte [ebp - 0x5a], 0x41
call fcn.1000456e
push eax
push esi
push dword [ebp + 8]
invalid
scasd eax, dword es:[edi]
sti
invalid

Function at 0x10004a24
Capabilities:
Contain obfuscated stackstrings
Inspect section memory permissions

Disassembly:
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
ja 0x100049ec
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
jb 0x100049f4
inc ebp
lea edi, [edx - 0x3a]
inc ebp
invalid
jae 0x100049fc
inc ebp
invalid
push edi
mov byte [ebp - 0x70], 0x16
invalid
sbb al, 0xfb
invalid
ja 0x100049ec
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid

Function at 0x10004a41
Capabilities:
Inspect section memory permissions

Disassembly:
dec eax
adc eax, 0x858da1aa
jl 0x10004a49
invalid
invalid

Function at 0x10004aea
Capabilities:
Inspect section memory permissions

Disassembly:
je 0x10004d4d
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x10004b03
cmp dword [eax + 0xc], ebx
je 0x10004ba6
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.1000455e
mov edx, 0x39570cd0
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid

Function at 0x10005221
Capabilities:
Contain obfuscated stackstrings

Disassembly:
enter 0xfffffffffffffffa, 0xffffffffffffffff
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x10005252
cmp dword [ebp - 0x398], 0
je 0x1000541c
cmp dword [ebp + 0xc], 1
je 0x1000541c
cmp dword [ebp + 0xc], 8
jne 0x100053e4
and byte [ebp - 0x6b8], 0
invalid
movsd dword es:[edi], dword [esi]
dec ecx
stc
invalid
invalid
Function at 0x403d19
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20030
call fcn.0042f8a0
push ebx
push esi
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040d7f7
lea eax, [ebp - 0x1002c]
push eax
xor ebx, ebx
push 0x7fff
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 7]
push eax
push dword [ebp + 8]
call fcn.004061ca
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x471cc1
mov eax, dword [0x4c1130]
test eax, eax
je 0x403e5d
xor edi, edi
inc edi
mov esi, 0x4c2100
cmp eax, edi
je 0x471cd9
lea eax, [ebp - 6]
push eax
push ecx
push 0x4c1130
push 0x4c1148
mov ecx, esi
call fcn.004040e5
test al, al
je 0x403e66
mov al, byte [0x4c2100]
mov byte [0x4c1134], al
mov al, byte [0x4c2101]
mov byte [ebp - 5], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2002c]
push eax
push 0x7fff
push dword [0x4c1148]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push dword [ebp - 0xc]
mov ecx, 0x4c1120
call fcn.00406a63
mov bl, byte [ebp - 6]
push dword [0x4c1130]
push 0x4c1148
call fcn.00406430
test eax, eax
jne 0x471cf8
cmp byte [ebp - 5], 1
je 0x471d17
call fcn.00403e6e
call fcn.004036b8
cmp byte [0x4c1134], 0
mov ebx, 0x4c1708
jne 0x403e1f
mov ecx, ebx
call fcn.00404ffc
push edi
mov ecx, 0x4c1160
call fcn.0040e8d0
cmp byte [0x4c1134], 0
jne 0x403e3a
mov ecx, ebx
call fcn.00403847
mov ecx, esi
call fcn.004052b5
lea eax, [ebp - 0x1002c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x2c]
call fcn.0040cb37
pop edi
pop esi
pop ebx
leave
ret 4
or dword [0x4c10bc], 0xffffffff
jmp 0x403e41
mov dword [0x4c10bc], edi
jmp 0x403e41
push 0x10
push 0x4b28f4
push str.This_is_a_third_party_compiled_AutoIt_script.
push ebx
call dword [0x48d720]
jmp 0x403e4e
push 0xffffffffffffffff
push dword [0x4c1138]
mov ecx, esi
push edi
call fcn.0041c682
mov al, byte [0x4c10c2]
mov byte [0x4c2102], al
jmp 0x403dde
mov ecx, esi
call fcn.004052b5
lea eax, [ebp - 0x1002c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x4c10bc], edi
jmp 0x403e4e
call fcn.004471fa
test al, al
jne 0x403e00
cmp byte [ebp - 7], al
jne 0x403e00
lea ecx, [ebp - 0x2c]
call fcn.00405374
push 0x49dab4
lea ecx, [ebp - 0x1c]
call fcn.0040ce19
lea ecx, [ebp - 0x1c]
test bl, bl
je 0x471d6e
mov edi, 0x4b2928
push edi
call fcn.0040518c
push 0x4c1148
lea ecx, [ebp - 0x1c]
call fcn.0040510d
push edi
lea ecx, [ebp - 0x1c]
call fcn.0040518c
push 1
jmp 0x471d77
push dword [ebp + 8]
call fcn.0040518c
push edi
lea eax, [ebp - 0x1002c]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x2c]
push 0x4b292c
call dword [0x48d71c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x1c]
call fcn.0040cb37
jmp 0x403e3a
Function at 0x41ea69
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push edi
mov edi, 0x4c1628
jne 0x47dc2c
mov ecx, dword [0x4c1694]
cmp ecx, 0xffffffff
je 0x41eb0f
mov eax, dword [0x4c1688]
push ebx
mov eax, dword [eax + ecx*4]
push esi
mov esi, dword [eax]
xor ecx, ecx
mov ebx, dword [esi]
cmp byte [esi + 0x3a], cl
je 0x41eabb
mov byte [esi + 0x3a], cl
cmp dword [esi + 0x18c], ecx
jge 0x47dc43
cmp dword [esi + 0x1a4], ecx
jne 0x47dc6a
mov edi, dword [ebp + 8]
cmp edi, 8
jg 0x47dc91
je 0x41eae3
test edi, edi
je 0x41eb30
cmp edi, 1
je 0x41eae3
cmp edi, 2
je 0x41eb27
cmp edi, 3
je 0x41eb1e
jle 0x41eb05
cmp edi, 5
jg 0x41eb13
cmp byte [esi + 0x38], 0
jne 0x41eb3e
push edi
push ebx
call dword [0x48d704]
cmp edi, 8
je 0x41eb01
cmp edi, 4
je 0x41eb01
push ebx
call fcn.0041eb42
mov byte [esi + 0x38], 1
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
pop ebp
ret 8
xor eax, eax
jmp 0x41eb0a
cmp edi, 6
je 0x47dc79
jmp 0x41eb05
mov byte [esi + 0x38], 1
jmp 0x47dce6
mov byte [esi + 0x38], 1
jmp 0x47dc79
push ecx
push ebx
call dword [0x48d704]
mov byte [esi + 0x38], 0
jmp 0x41eb05
xor eax, eax
jmp 0x41eb08
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0041b34e
mov ecx, eax
mov dword [0x4c1694], ecx
jmp 0x41ea82
cmp byte [esi + 0x198], cl
je 0x41eaaf
push dword [esi + 0x194]
mov ecx, edi
push esi
call fcn.0046e397
xor ecx, ecx
mov byte [esi + 0x198], cl
jmp 0x41eaaf
push dword [esi]
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor ecx, ecx
jmp 0x41eabb
cmp byte [esi + 0x38], 0
je 0x41eb3e
push 6
push ebx
call dword [0x48d704]
jmp 0x41eb05
mov eax, edi
sub eax, 9
je 0x47dce6
sub eax, 0x37
je 0x47dcd8
dec eax
je 0x47dcd5
dec eax
je 0x47dcc5
dec eax
jne 0x41eb05
push ecx
mov byte [esi + 0x39], cl
call dword [0x48d6cc]
push 1
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x41eb05
push ebx
mov byte [esi + 0x39], 1
call dword [0x48d6cc]
jmp 0x41eb05
push ecx
jmp 0x47dcda
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x41eb05
cmp byte [esi + 0x38], 0
je 0x41eb3e
push edi
push ebx
call dword [0x48d704]
push ebx
call fcn.0041eb42
jmp 0x41eb05
Function at 0x41eb42
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
call dword [0x48d71c]
mov ebx, dword [ebp + 8]
mov esi, eax
cmp ebx, esi
jne 0x473add
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret 4
push edi
xor edi, edi
test esi, esi
jne 0x473af2
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push ebx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x473b06
push 9
push ebx
call dword [0x48d704]
push ebx
mov dword [ebp - 0xc], edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x473be1
push edi
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebx
mov dword [ebp + 8], eax
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
call esi
push 1
push edi
push dword [ebp + 8]
call esi
push 1
push dword [ebp - 4]
push edi
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x473bbd
mov edi, dword [0x48d674]
push eax
push eax
push eax
push 0x12
call edi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
xor eax, eax
push eax
push eax
push eax
push 0x12
call edi
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, dword [ebp - 8]
test eax, eax
je 0x473bc2
push 4
jmp 0x473bbf
push 3
pop ebx
jmp 0x473bc5
mov ebx, dword [ebp - 0xc]
push 0
push dword [ebp - 4]
push dword [ebp + 8]
call esi
push 0
push edi
push dword [ebp + 8]
call esi
push 0
push dword [ebp - 4]
push edi
call esi
jmp 0x473be4
push 2
pop ebx
mov eax, ebx
pop edi
jmp 0x41eb60
Function at 0x43c82d
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp byte [ebp + 0xc], 1
jne 0x43c858
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x43c871
push 1
jmp 0x43c859
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
pop ebp
ret 8

Function at 0x43d4f2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov ebx, ecx
mov ecx, dword [ebp + 8]
push edi
mov dword [ebp - 8], ebx
call fcn.0040bcce
push dword [ebx]
call fcn.0040103b
test al, al
je 0x43d517
xor al, al
jmp 0x43d593
mov ecx, ebx
call fcn.0043d59a
mov ebx, eax
test ebx, ebx
jne 0x43d529
mov ebx, 0x7fff
xor ecx, ecx
push 2
lea esi, [ebx + 1]
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041f4ea
pop ecx
mov edi, eax
mov eax, dword [ebp - 8]
push edi
push esi
push 0xd
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x43d58a
push edi
call fcn.004217d0
pop ecx
push edi
cmp eax, ebx
jne 0x43d582
lea ecx, [ebp - 0x18]
call fcn.0043d2ff
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0040c1de
lea ecx, [ebp - 0x18]
call fcn.0040cb37
jmp 0x43d58a
mov ecx, dword [ebp + 8]
call fcn.00406a63
push edi
call fcn.0041f55e
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4438a3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
movzx edi, al
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bl, 1
cmp byte [ebp + 0xc], bl
je 0x443904
push esi
mov esi, dword [0x48d674]
push ecx
push 0
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0044411c
mov ecx, dword [ebp - 4]
call fcn.00442b1c
push ecx
push 2
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0044411c
mov ecx, dword [ebp - 4]
call fcn.00442b03
pop esi
pop edi
mov al, bl
pop ebx
leave
ret 8

Function at 0x44390c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, word [edi + 8]
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
mov byte [ebp - 8], bl
mov byte [ebp - 4], bh
mov dword [ebp - 0xc], eax
je 0x4439f7
cmp bl, 0x14
je 0x4439f7
cmp bl, 0x90
je 0x4439f7
cmp bl, 0x91
je 0x4439f7
mov ecx, edi
call fcn.00442e0a
test al, al
je 0x4439de
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x443988
movzx eax, bl
or byte [ebp + eax - 0x128], 0x80
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov ecx, dword [ebp + 8]
movzx edi, bh
shl edi, 0x10
or edi, 1
call fcn.00442d4a
cmp al, 1
jne 0x4439a3
or edi, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x4439b4
cmp byte [esi + 0x1d], 0
jne 0x4439b4
cmp bl, 0x12
jne 0x4439d2
cmp byte [esi + 0x16], 0
jne 0x4439d2
cmp byte [esi + 0x1c], 0
jne 0x4439d2
or edi, 0x20000000
movzx eax, bl
push edi
push eax
push 0x104
jmp 0x4439ec
movzx eax, bl
push edi
push eax
push 0x100
jmp 0x4439ec
mov eax, dword [ebp - 0xc]
movzx eax, ax
push 1
push eax
push 0x102
push dword [esi + 0x20]
call dword [0x48d678]
jmp 0x443a53
mov ecx, edi
call fcn.00442e0a
test al, al
je 0x443a23
mov ecx, edi
call fcn.00442d4a
push ecx
mov ecx, esi
cmp al, 1
jne 0x443a14
push 1
jmp 0x443a16
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0044411c
jmp 0x443a53
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
xor eax, eax
mov word [ebp - 0x24], ax
movzx eax, word [edi + 8]
mov word [ebp - 0x22], ax
push 0x1c
xor ecx, ecx
lea eax, [ebp - 0x28]
inc ecx
push eax
push ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 4
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.00442b1c
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x443a61
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov bl, byte [edi]
cmp dword [esi + 0x20], 0
mov bh, byte [edi + 7]
mov byte [ebp - 4], bl
mov byte [ebp - 8], bh
je 0x443b3c
cmp bl, 0x14
je 0x443b3c
cmp bl, 0x90
je 0x443b3c
cmp bl, 0x91
je 0x443b3c
mov ecx, edi
call fcn.00442e0a
test al, al
je 0x443b98
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x443ada
movzx eax, bl
xor byte [ebp + eax - 0x124], 0x80
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov ecx, dword [ebp + 8]
movzx edi, bh
shl edi, 0x10
or edi, 0xc0000001
call fcn.00442d4a
cmp al, 1
jne 0x443af8
or edi, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x443b09
cmp byte [esi + 0x1d], 0
jne 0x443b09
cmp bl, 0x12
jne 0x443b27
cmp byte [esi + 0x16], 0
jne 0x443b27
cmp byte [esi + 0x1c], 0
jne 0x443b27
or edi, 0x20000000
movzx eax, bl
push edi
push eax
push 0x105
jmp 0x443b31
movzx eax, bl
push edi
push eax
push 0x101
push dword [esi + 0x20]
call dword [0x48d678]
jmp 0x443b98
mov ecx, edi
call fcn.00442e0a
test al, al
je 0x443b68
mov ecx, edi
call fcn.00442d4a
push ecx
mov ecx, esi
cmp al, 1
jne 0x443b59
push 3
jmp 0x443b5b
push 2
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0044411c
jmp 0x443b98
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
xor eax, eax
mov word [ebp - 0x20], ax
movzx eax, word [edi + 8]
mov word [ebp - 0x1e], ax
push 0x1c
xor ecx, ecx
lea eax, [ebp - 0x24]
inc ecx
push eax
push ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], 6
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.00442b03
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x443bc3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
cmp byte [esi], 0
mov edi, ecx
jne 0x443bf4
cmp byte [esi + 1], 0
jne 0x443bf4
cmp byte [esi + 2], 0
jne 0x443bf4
cmp byte [esi + 3], 0
jne 0x443bf4
cmp byte [esi + 4], 0
je 0x443da2
cmp dword [edi + 0x20], 0
push ebx
je 0x443d2a
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x443d2a
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x443c7e
cmp byte [esi], 0
mov al, byte [ebp - 0xf0]
mov ecx, 0x80
je 0x443c3c
or al, cl
or byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x443c4d
or al, cl
or byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x443c59
or byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x443c65
or byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x443c71
or byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [0x48d678]
jne 0x443c8f
cmp byte [esi + 1], 0
je 0x443ca6
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 1
push eax
push 0x10
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x443cc3
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push 0x100
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x443d07
cmp byte [esi + 2], 0
jne 0x443cec
cmp byte [edi + 0x1c], 0
jne 0x443cec
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0x20000001
push eax
push 0x12
push 0x104
jmp 0x443d02
test al, al
je 0x443d07
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 1
push eax
push 0x12
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x443d9a
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 1
push eax
push 0x5b
push 0x100
push dword [edi + 0x20]
call ebx
jmp 0x443d9a
xor ebx, ebx
cmp byte [esi], bl
je 0x443d43
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 1], bl
je 0x443d5b
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 2], bl
je 0x443d70
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 3], bl
je 0x443d85
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 4], bl
je 0x443d9a
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.0044411c
mov ecx, edi
call fcn.00442b1c
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x443da8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
cmp byte [esi], 0
mov edi, ecx
jne 0x443dd9
cmp byte [esi + 1], 0
jne 0x443dd9
cmp byte [esi + 2], 0
jne 0x443dd9
cmp byte [esi + 3], 0
jne 0x443dd9
cmp byte [esi + 4], 0
je 0x443f95
cmp dword [edi + 0x20], 0
push ebx
je 0x443f17
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x443f17
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x443e63
cmp byte [esi], 0
mov al, byte [ebp - 0xf0]
mov ecx, 0x80
je 0x443e21
xor al, cl
xor byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x443e32
xor al, cl
xor byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x443e3e
xor byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x443e4a
xor byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x443e56
xor byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [0x48d678]
jne 0x443e74
cmp byte [esi + 1], 0
je 0x443e8d
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x10
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x443eac
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x11
push 0x101
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x443ef2
cmp byte [esi + 2], 0
jne 0x443ed5
cmp byte [edi + 0x1c], 0
jne 0x443ed5
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
jmp 0x443eed
test al, al
je 0x443ef2
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x443f8d
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push dword [edi + 0x20]
call ebx
jmp 0x443f8d
cmp byte [esi], 0
push 2
pop ebx
je 0x443f32
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 1], 0
je 0x443f4b
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 2], 0
je 0x443f61
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 3], 0
je 0x443f77
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 4], 0
je 0x443f8d
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.0044411c
mov ecx, edi
call fcn.00442b03
pop ebx
pop edi
pop esi
leave
ret 4