joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f8a4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004383c8
and dword [ebp - 4], 0
cmp dword [0x4950f0], 0
mov ebx, eax
jne 0x43f955
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43fa06
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x475504
push edi
call esi
test eax, eax
je 0x43fa06
push eax
call fcn.00438356
mov dword [esp], 0x4754f4
push edi
mov dword [0x4950f0], eax
call esi
push eax
call fcn.00438356
mov dword [esp], 0x4754e0
push edi
mov dword [0x4950f4], eax
call esi
push eax
call fcn.00438356
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4950f8], eax
call esi
push eax
call fcn.00438356
pop ecx
mov dword [0x495100], eax
test eax, eax
je 0x43f955
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00438356
pop ecx
mov dword [0x4950fc], eax
mov eax, dword [0x4950fc]
cmp eax, ebx
je 0x43f9ad
cmp dword [0x495100], ebx
je 0x43f9ad
push eax
call fcn.004383d1
push dword [0x495100]
mov esi, eax
call fcn.004383d1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43f9ad
test edi, edi
je 0x43f9ad
call esi
test eax, eax
je 0x43f9a4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43f9a4
test byte [ebp - 0xc], 1
jne 0x43f9ad
or dword [ebp + 0x10], 0x200000
jmp 0x43f9e6
mov eax, dword [0x4950f4]
cmp eax, ebx
je 0x43f9e6
push eax
call fcn.004383d1
pop ecx
test eax, eax
je 0x43f9e6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43f9e6
mov eax, dword [0x4950f8]
cmp eax, ebx
je 0x43f9e6
push eax
call fcn.004383d1
pop ecx
test eax, eax
je 0x43f9e6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4950f0]
call fcn.004383d1
pop ecx
test eax, eax
je 0x43fa06
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43fa08
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402d80
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x40
push ebx
push esi
push edi
push 0x40
push 0x3000
push 0x51ab4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
mov ecx, 0x146a9
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, 0x2358
mov esi, 0x40a170
mov edi, ebx
lea eax, [ebx + 0x8d60]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x3b60
mov esi, 0x412ed0
mov edi, eax
add eax, 0xed80
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x3cd0
mov esi, 0x421c50
mov edi, eax
add eax, 0xf340
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x3118
mov esi, 0x430f90
mov edi, eax
add eax, 0xc460
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x297c
mov esi, 0x43d3f0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x508d
mov esi, 0x4479e0
lea edi, [eax + 0xa5f0]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xd], eax
mov byte [esp + 0xc], 0
mov dword [esp + 0x11], eax
xor edi, edi
mov dword [esp + 0x15], eax
mov esi, ebx
mov word [esp + 0x19], ax
mov byte [esp + 0x1b], al
mov eax, edi
push 1
cdq
and edx, 0x7f
push 0x10
add eax, edx
sar eax, 7
cmp eax, 5
jg 0x402e62
lea ecx, [eax + eax*8]
lea edx, [ecx*2 + 0x45bc18]
lea ecx, [esp + 0x24]
push edx
call fcn.00405f80
lea ecx, [esp + 0x1c]
jmp 0x402e74
push 0x45bc72
lea ecx, [esp + 0x40]
call fcn.00405f80
lea ecx, [esp + 0x34]
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00405fe0
mov ecx, dword [esp + 0xc]
inc edi
mov dword [esi], ecx
mov edx, dword [esp + 0x10]
mov dword [esi + 4], edx
add esi, 8
cmp edi, 0xa355
jb 0x402e34
mov eax, dword [esp + 0x50]
pop edi
pop esi
mov dword [eax], ebx
mov eax, 0x51aa4
pop ebx
add esp, 0x40
ret

Function at 0x402fc0
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
mov eax, dword [0x45c874]
push 0x20
push 0x45c87c
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
call fcn.004037f0
xor eax, eax
mov cl, byte [eax + 0x45c89c]
mov byte [eax + 0x45c3e0], cl
inc eax
test cl, cl
jne 0x402fda
xor eax, eax
mov cl, byte [eax + 0x45c87c]
mov byte [eax + 0x45c440], cl
inc eax
test cl, cl
jne 0x402fed
push esi
push edi
call fcn.00403370
call fcn.004037c0
mov ecx, dword [0x45c868]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push 0x80
push 0
push 0
push 0x1200
push 0x1ef0
push 1
push ecx
call esi
mov edx, dword [0x45c5f8]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x45c5f8]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [0x45c5f8]
push 3
push 0xdf
push 0x177
push 0x120
push 0x1ef
push 0xffffffffffffffff
push ecx
call esi
mov edi, 0x45c3e0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4030b9
mov esi, dword [0x45c8fc]
mov eax, 0x45c3e0
lea edx, [esi + esi*4]
lea edx, [esi + edx*2]
shl edx, 3
mov ecx, edx
sub ecx, eax
lea edi, [ecx + 0x45be60]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x403099
inc esi
pop edi
mov dword [0x45c8fc], esi
mov dword [edx + 0x45beb4], 0x40
pop esi
ret 4
mov eax, dword [0x45c8fc]
pop edi
inc eax
pop esi
mov dword [0x45c8fc], eax
ret 4
Function at 0x403290
Capabilities:
Get common file path

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
xor bl, bl
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x14], 0xe6
mov byte [esp + 0x15], 0xb2
mov byte [esp + 0x16], 0xb9
mov byte [esp + 0x17], 0xec
mov byte [esp + 0x18], 0xfc
mov byte [esp + 0x19], 0xba
mov byte [esp + 0x1a], 0xbe
mov byte [esp + 0x1b], 0xb7
mov byte [esp + 0x1c], bl
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x14]
push ecx
push eax
call fcn.00406570
lea ecx, [esp + 0x14]
push 5
push ecx
mov byte [esp + 0x1c], 0x8f
mov byte [esp + 0x1d], 0xbb
mov byte [esp + 0x1e], 0xbf
mov byte [esp + 0x1f], 0xb6
mov byte [esp + 0x20], 0x8b
mov byte [esp + 0x21], bl
call fcn.00406570
mov ebx, dword [esp + 0x34]
add esp, 0x10
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x403370
Capabilities:
Create thread

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push 0
push ecx
push 0x4033a0
push 0
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 8
ret

Function at 0x4037c0
Capabilities:
Create thread

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push 0
push ecx
push 0x403470
push 0
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 8
ret
Function at 0x4039c0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x45c870]
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowTextA]
push eax
push ecx
call esi
mov edx, dword [esp + 0xc]
push 0
push 0xf020
push 0x112
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x45c874]
push 0x45c918
push eax
call esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
call esi
mov ecx, dword [0x45c868]
push 0xffffffffffffffec
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edx, dword [0x45c868]
or al, 0x80
push eax
push 0xffffffffffffffec
push edx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [0x45c868]
push 1
push 0xdf
push 0x177
push 0x120
push 0x1ef
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [0x45c868]
push 1
push 0xdf
push 0x177
push 0x120
push 0x1ef
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [0x45c868]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x45c868]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [0x45c8f8], 1
pop esi
ret
Function at 0x4045d0
Capabilities:
Initialize winsock library
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x1b4
mov al, 0xea
push ebx
mov byte [esp + 4], al
mov byte [esp + 6], al
mov al, 0xe6
push ebp
mov byte [esp + 0x11], al
mov byte [esp + 0x13], al
push esi
mov esi, dword [esp + 0x1c4]
lea eax, [esp + 0x1c]
push edi
push eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
mov byte [esp + 0x15], 0xe2
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], ebp
push ecx
push esi
mov byte [esp + 0x1f], 0xf6
mov byte [esp + 0x20], 0xe9
mov byte [esp + 0x21], 0xef
mov byte [esp + 0x22], 0xf3
mov byte [esp + 0x23], 0xed
mov byte [esp + 0x24], 0xe5
mov byte [esp + 0x26], 0xff
mov byte [esp + 0x28], 0xe4
mov byte [esp + 0x29], 0
call fcn.00404450
mov ebx, eax
add esp, 0xc
cmp ebx, ebp
jle 0x404735
lea ecx, [esp + 0x34]
push ecx
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x404673
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1b4
ret
push ebp
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x404698
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1b4
ret
mov edx, esi
lea ecx, [esp + 0x10]
mov word [esp + 0x24], 2
lea eax, [esp + 0x10]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4046ab
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.00406570
add esp, 8
push esi
call dword [sym.imp.WSOCK32.dll_inet_addr]
push 0x2279
mov dword [esp + 0x2c], eax
call dword [sym.imp.WSOCK32.dll_htons]
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x24]
push 0x10
push edx
push 0
push ebx
push esi
push ebp
mov word [esp + 0x3e], ax
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
jne 0x40471b
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push ebp
call dword [sym.imp.WSOCK32.dll_closesocket]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1b4
ret
push ebp
call dword [sym.imp.WSOCK32.dll_closesocket]
test esi, esi
je 0x404730
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov ebp, 1
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x1b4
ret
Function at 0x405660
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x310]
test eax, eax
jne 0x405687
push 0
push 0
push esi
push 0x405650
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x310], eax
pop esi
ret
Function at 0x405fd0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
jmp 0x405ff0
sub esp, 8
mov edx, dword [esp + 0xc]
mov al, byte [ecx + 4]
push ebx
push esi
mov esi, dword [edx]
mov ebx, dword [ecx + 9]
mov byte [esp + 0x14], al
mov eax, esi
mov esi, dword [ecx + 0xd]
mov edx, dword [edx + 4]
mov dword [esp + 0xc], esi
mov esi, dword [ecx + 0x11]
push edi
mov edi, dword [ecx + 5]
mov ecx, dword [ecx]
mov dword [esp + 0xc], esi
xor esi, esi
test ecx, ecx
je 0x40606f
mov dword [esp + 0x18], ecx
push ebp
mov ecx, edx
mov ebp, edx
shr ecx, 5
shl ebp, 4
sub esi, 0x61c88647
add ecx, ebx
add ebp, edi
xor ecx, ebp
lea ebp, [esi + edx]
xor ecx, ebp
mov ebp, dword [esp + 0x10]
add eax, ecx
mov ecx, eax
shr ecx, 5
add ecx, ebp
mov ebp, eax
shl ebp, 4
add ebp, dword [esp + 0x14]
xor ecx, ebp
lea ebp, [esi + eax]
xor ecx, ebp
add edx, ecx
mov ecx, dword [esp + 0x1c]
dec ecx
mov dword [esp + 0x1c], ecx
jne 0x406029
pop ebp
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov dword [ecx + 4], edx
add esp, 8
ret 8

Function at 0x405fe0
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
jmp 0x406090
sub esp, 8
mov eax, dword [esp + 0xc]
mov dl, byte [ecx + 4]
push ebx
mov ebx, dword [ecx + 9]
push esi
mov esi, dword [eax]
mov byte [esp + 0x14], dl
mov edx, esi
mov esi, dword [ecx + 0xd]
mov eax, dword [eax + 4]
push edi
mov edi, dword [ecx + 5]
mov dword [esp + 0x10], esi
mov esi, dword [ecx + 0x11]
mov ecx, dword [ecx]
mov dword [esp + 0xc], esi
cmp ecx, 0x20
jne 0x4060ca
mov esi, 0xc6ef3720
jmp 0x4060e2
cmp ecx, 0x10
jne 0x4060d6
mov esi, 0xe3779b90
jmp 0x4060e2
mov esi, ecx
imul esi, esi, 0x9e3779b9
test ecx, ecx
je 0x40612d
push ebp
mov dword [esp + 0x1c], ecx
mov ebp, dword [esp + 0x10]
mov ecx, edx
shr ecx, 5
add ecx, ebp
mov ebp, edx
shl ebp, 4
add ebp, dword [esp + 0x14]
xor ecx, ebp
lea ebp, [esi + edx]
xor ecx, ebp
sub eax, ecx
mov ecx, eax
mov ebp, eax
shr ecx, 5
shl ebp, 4
add ecx, ebx
add ebp, edi
xor ecx, ebp
lea ebp, [esi + eax]
xor ecx, ebp
add esi, 0x61c88647
sub edx, ecx
mov ecx, dword [esp + 0x1c]
dec ecx
mov dword [esp + 0x1c], ecx
jne 0x4060e7
pop ebp
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword [ecx], edx
mov dword [ecx + 4], eax
add esp, 8
ret 8
Function at 0x406570
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
mov cl, dl
sub cl, 0x32
test edx, edx
not cl
jle 0x40656a
push ebx
push esi
mov esi, dword [esp + 0xc]
mov bl, al
not bl
xor bl, byte [eax + esi]
xor bl, cl
mov byte [eax + esi], bl
inc eax
cmp eax, edx
jl 0x406557
pop esi
pop ebx
mov eax, 1
ret
jmp 0x406540

Function at 0x406600
Capabilities:
Hash data using djb2

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, 0x1505
je 0x40663c
movsx eax, byte [esi + ebx]
mov ecx, edx
mov edi, ebx
shl ecx, 5
add ecx, edx
add eax, ecx
or ecx, 0xffffffff
mov edx, eax
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jb 0x40661c
pop edi
pop esi
mov eax, edx
pop ebx
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x489294]
shl eax, 2
mov dword [0x489298], eax
push edi
push ecx
xor eax, eax
mov edi, 0x49953c
mov ecx, 0x4a0934
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push edx
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov edx, eax
call fcn.0047b250
pop edx
push 0
call fcn.0047c0d4
pop ecx
push 0x48925c
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x48929c], eax
push 0
jmp fcn.00483178

Function at 0x40a8bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edx, edx
mov eax, dword [ebp + 0xc]
xor byte [eax], 0xa5
inc edx
inc eax
cmp edx, 0x80
jl 0x40a8c7
xor esi, esi
mov eax, dword [ebp + 0xc]
lea edi, [eax + 4]
xor edx, edx
mov eax, edi
mov cl, byte [eax]
mov bl, byte [eax - 4]
mov byte [eax], bl
mov byte [eax - 4], cl
inc edx
inc eax
cmp edx, 4
jl 0x40a8e0
inc esi
add edi, 8
cmp esi, 0x10
jl 0x40a8dc
xor esi, esi
mov eax, dword [ebp + 0xc]
lea edi, [eax + 0x10]
xor edx, edx
mov eax, edi
mov cl, byte [eax]
mov bl, byte [eax - 0x10]
mov byte [eax], bl
mov byte [eax - 0x10], cl
inc edx
inc eax
cmp edx, 0x10
jl 0x40a906
inc esi
add edi, 0x20
cmp esi, 4
jl 0x40a902
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40a928
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov edx, eax
mov eax, 0x48e860
mov bl, byte [eax]
xor byte [edx], bl
inc ecx
inc edx
inc eax
cmp ecx, 0x80
jl 0x40a938
pop ebx
pop ebp
ret
Function at 0x42415c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x490428
test edx, edx
jne 0x42417b
xor eax, eax
jmp 0x424299
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x424198
push esi
push edx
push eax
call fcn.004242a0
add esp, 0xc
jmp 0x424299
push esi
push edx
push eax
call fcn.00424560
add esp, 0xc
jmp 0x424299
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x425eb4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x74]
sub eax, dword [ebx + 0x6c]
mov dword [ebp - 8], eax
jmp 0x425eef
mov edx, dword [ebx + 0x2c]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x6c]
ja 0x425f70
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.0047b2cc
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], edi
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x425f3d
mov cx, word [ebp - 4]
sub cx, si
jmp 0x425f3f
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x425f26
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x425f65
mov cx, word [ebp - 4]
sub cx, si
jmp 0x425f67
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x425f4e
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0x425fd2
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x38]
add edx, dword [ebx + 0x6c]
add edx, dword [ebx + 0x74]
push edx
push edi
call fcn.00425b78
add esp, 0xc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x425fbd
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x425fd2
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x425ec3
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x42c024
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0xca
jne 0x42c057
push ebx
call fcn.0042cc54
cmp dword [ebx + 0x3c], 0
pop ecx
je 0x42c050
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
pop ebp
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x42c0c9
mov edx, dword [ebx + 0x1b0]
cmp dword [edx + 0x10], 0
je 0x42c0bb
cmp dword [ebx + 8], 0
je 0x42c079
push ebx
mov ecx, dword [ebx + 8]
call dword [ecx]
pop ecx
push ebx
mov eax, dword [ebx + 0x1b0]
call dword [eax]
pop ecx
test eax, eax
jne 0x42c08c
xor eax, eax
pop ebx
pop ebp
ret
cmp eax, 2
je 0x42c0bb
cmp dword [ebx + 8], 0
je 0x42c06c
cmp eax, 3
je 0x42c09f
dec eax
jne 0x42c06c
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x42c06c
mov edx, dword [ebx + 0x13c]
add dword [eax + 8], edx
jmp 0x42c06c
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x42c0e7
cmp dword [ebx + 0x14], 0xcc
je 0x42c0e7
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
push ebx
mov ecx, dword [ebx]
call dword [ecx]
pop ecx
push ebx
call fcn.0042c0f4
pop ecx
pop ebx
pop ebp
ret

Function at 0x42c0f4
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0xcc
je 0x42c18f
push ebx
mov eax, dword [ebx + 0x1a0]
call dword [eax]
pop ecx
xor edx, edx
mov dword [ebx + 0x88], edx
mov dword [ebx + 0x14], 0xcc
jmp 0x42c18f
mov eax, dword [ebx + 8]
test eax, eax
je 0x42c13d
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x70]
mov dword [eax + 8], edx
push ebx
mov ecx, dword [ebx + 8]
call dword [ecx]
pop ecx
mov esi, dword [ebx + 0x88]
lea eax, [ebx + 0x88]
push 0
push eax
push 0
push ebx
mov edx, dword [ebx + 0x1a4]
call dword [edx + 4]
add esp, 0x10
cmp esi, dword [ebx + 0x88]
jne 0x42c167
xor eax, eax
jmp 0x42c1af
mov edx, dword [ebx + 0x88]
cmp edx, dword [ebx + 0x70]
jb 0x42c126
push ebx
mov ecx, dword [ebx + 0x1a0]
call dword [ecx + 4]
pop ecx
push ebx
mov eax, dword [ebx + 0x1a0]
call dword [eax]
pop ecx
xor edx, edx
mov dword [ebx + 0x88], edx
mov ecx, dword [ebx + 0x1a0]
cmp dword [ecx + 8], 0
jne 0x42c167
cmp dword [ebx + 0x40], 0
mov eax, 0xce
jne 0x42c1a7
dec eax
mov dword [ebx + 0x14], eax
mov eax, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x43f164
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004797a8
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43f1c5
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x43f1c5
cmp byte [ebp - 0x102], 0
je 0x43f1c5
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.004799d4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44056c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x28], 0
je 0x4405ed
xor eax, eax
mov al, byte [ebx + 4]
mov word [ebp - 6], ax
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x44059e
add word [ebp - 6], 0x2000
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4405b0
add word [ebp - 6], 0x4000
test byte [ebx + 0xb], 0x20
je 0x4405bc
add word [ebp - 6], 0x8000
xor ebx, ebx
movzx edx, word [ebp - 6]
mov cl, 2
mov eax, dword [ebp - 0xc]
call fcn.004403f8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4405e1
push ebp
mov eax, dword [ebp - 4]
call fcn.004404dc
pop ecx
mov ebx, eax
cmp bl, 2
je 0x4405bc
cmp dword [ebp - 4], 0
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x441ff0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x204], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44218b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp esi, 1
jl 0x44203a
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.00441ac0
mov eax, dword [ebp - 0x204]
mov edx, esi
call fcn.00475d74
cmp al, 1
jne 0x44203a
dec esi
mov eax, ebx
call fcn.00441dd4
test al, al
je 0x44212b
test esi, esi
jge 0x44204f
xor esi, esi
lea edi, [esi + 1]
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.00441ac0
mov eax, dword [ebp - 0x204]
call fcn.00479a24
cmp edi, eax
jge 0x442096
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.00441ac0
mov eax, dword [ebp - 0x204]
mov al, byte [eax + edi - 1]
mov edx, dword [0x499384]
and eax, 0xff
bt dword [edx], eax
jae 0x442096
inc edi
mov eax, dword [ebx + 0x138]
cmp esi, eax
jl 0x4420a4
mov esi, eax
mov edi, esi
mov ecx, edi
mov edx, edi
mov eax, ebx
call fcn.00441fcc
cmp edi, esi
je 0x442123
lea eax, [ebp - 0x100]
push eax
call sub.USER32.dll_GetKeyboardState
mov edx, 0x100
lea eax, [ebp - 0x200]
mov byte [eax], 0
inc eax
dec edx
jne 0x4420ca
mov byte [ebp - 0x1f0], 0x81
mov byte [ebp - 0x1db], 0x81
lea eax, [ebp - 0x200]
push eax
call sub.USER32.dll_SetKeyboardState
push 1
push 0x25
push 0x100
mov eax, ebx
call fcn.004652d0
push eax
call sub.USER32.dll_SendMessageA
push 1
push 0x25
push 0x101
mov eax, ebx
call fcn.004652d0
push eax
call sub.USER32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call sub.USER32.dll_SetKeyboardState
mov dword [ebx + 0x140], esi
jmp 0x442172
test esi, esi
jge 0x442131
xor esi, esi
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.00441ac0
mov eax, dword [ebp - 0x204]
call fcn.00479a24
cmp esi, eax
jl 0x442167
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.00441ac0
mov eax, dword [ebp - 0x204]
call fcn.00479a24
mov esi, eax
mov ecx, esi
mov edx, esi
mov eax, ebx
call fcn.00441fcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442192
lea eax, [ebp - 0x204]
call fcn.004797a8
ret