joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4094b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40a398
push 0x409786
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov dword [ebp - 0x20], edi
push str.RegCreateKeyExA
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x24], eax
push str.RegSetValueExA
push edi
call esi
mov dword [ebp - 0x28], eax
push str.RegDeleteKeyA
push edi
call esi
mov dword [ebp - 0x2c], eax
push str.RegDeleteValueA
push edi
call esi
mov dword [ebp - 0x30], eax
push str.RegOpenKeyExA
push edi
call esi
mov ebx, eax
push str.RegCloseKey
push edi
call esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x20]
cmp eax, 3
ja case.0x4095a7.3
jmp dword [eax*4 + 0x409674]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x3c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x24]
test eax, eax
jne case.0x4095a7.3
lea ecx, [ebp - 0x3c]
push ecx
push 0x2001f
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call ebx
test eax, eax
jne case.0x4095a7.3
mov ebx, dword [ebp + 0x14]
lea eax, [ebx - 1]
cmp eax, 6
ja case.0x4095a7.3
xor ecx, ecx
mov cl, byte [eax + 0x409690]
jmp dword [ecx*4 + 0x409684]
mov esi, dword [ebp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push ebx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x3c]
push eax
call dword [ebp - 0x28]
jmp 0x40962b
push 4
lea ecx, [ebp + 0x1c]
push ecx
push ebx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x3c]
push eax
call dword [ebp - 0x28]
jmp 0x40962b
lea ecx, [ebp - 0x3c]
push ecx
push 0x2001f
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call ebx
test eax, eax
jne case.0x4095a7.3
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
call dword [ebp - 0x2c]
jmp 0x40962b
lea eax, [ebp - 0x3c]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call ebx
test eax, eax
jne case.0x4095a7.3
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [ebp - 0x30]
test eax, eax
jne case.0x4095a7.3
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.00409664
test edi, edi
je 0x40964d
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4096a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4096be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4096be
xor eax, eax
ret
mov eax, 1
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4086ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x4086d9
pop dword [ebp - 0x48]
mov eax, 0x4086d9
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x908bf9dd
sub dword [ebp - 0x58], 0x4239b492
mov dword [ebp - 0x54], 0xd4f4c312
add dword [ebp - 0x54], 0x5d3e8933
mov dword [ebp - 0x50], 0xfd9674e0
sub dword [ebp - 0x50], 0xb14a30b2
mov dword [ebp - 0x4c], 0x62ae9961
sub dword [ebp - 0x4c], 0x62ae9961
lea eax, [ebp - 0x58]
push eax
mov eax, 0xbb7f9b9b
sub eax, 0xbb3ecb47
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xf2f12bb7
add dword [ebp - 0x58], 0x81813d9f
mov dword [ebp - 0x54], 0xfb816768
add dword [ebp - 0x54], 0x45eafa0d
mov dword [ebp - 0x50], 0x17e9f737
sub dword [ebp - 0x50], 0xb47a8acb
mov dword [ebp - 0x4c], 0x196c4b2b
add dword [ebp - 0x4c], 0xe693b4d5
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x38769
push 0
call eax
mov ecx, 0x43c6
xor esi, esi
add esi, eax
mov edx, 0x44eaea8
sub edx, 0x40cfea8
add edx, dword [ebp - 0x48]
mov edi, 0x93a233ae
add edi, 0xacacedf7
xor dword [ebp - 0xc], 0x9fc9eb89
mov ebx, dword [edx]
sub dword [ebp - 0x24], edi
xor ebx, edi
add dword [ebp - 0x18], eax
mov dword [esi], ebx
mov dword [ebp - 0x24], 0x26893aa4
add esi, 0xf80f3d6d
add esi, 0x7f0c297
add edx, 0xc3ddeba7
sub edx, 0xc3ddeba3
loop 0x4087ed
add eax, 0x62f0b78
sub eax, 0x62e098d
mov ebx, eax
add eax, 0x352e4c93
sub eax, 0x352e4c8e
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x402ee4
pop dword [ebp - 0x14]
mov eax, 0x402ee4
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x311920ef
add dword [ebp - 0x24], 0x1d39245c
mov dword [ebp - 0x20], 0xa514d38a
sub dword [ebp - 0x20], 0x72e18745
mov dword [ebp - 0x1c], 0x948c4d37
sub dword [ebp - 0x1c], 0x48400909
mov dword [ebp - 0x18], 0x121afbd
sub dword [ebp - 0x18], 0x121afbd
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x249af8cd
add dword [ebp - 0x24], 0x4fd77089
mov dword [ebp - 0x20], 0xe73705aa
add dword [ebp - 0x20], 0x5a355bcb
mov dword [ebp - 0x1c], 0x492b67eb
sub dword [ebp - 0x1c], 0xe5bbfb7f
mov dword [ebp - 0x18], 0x1853d1ae
sub dword [ebp - 0x18], 0x1853d1ae
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x35b73
push 0
call eax
mov ecx, 0x42b8
mov edx, eax
mov ebx, 0xe354a773
add ebx, 0x1cf23c8d
add ebx, dword [ebp - 0x14]
mov esi, 0x37297aa6
add esi, 0xeb1105f
mov dword [ebp - 0x10], 0x36b6798d
mov edi, dword [ebx]
add edi, esi
xor dword [ebp - 0xc], 0x1261c4fd
mov dword [edx], edi
sub dword [ebp - 4], 0xbbdf157a
add edx, 4
add ebx, 4
loop 0x402ff1
add eax, 0xec8bf6f4
sub eax, 0xec8af941
xor ebx, ebx
add ebx, eax
add eax, 0xd6155fa1
sub eax, 0xd6155f9c
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x403ab4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x47b020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403b4c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403b2c
xor eax, eax
push ebp
push 0x403b25
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403b68
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403b2c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x47b020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x47b020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404960
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47e048], 0
je 0x4049c1
cmp word [0x47e21c], 0xd7b2
jne 0x404989
cmp dword [0x47e224], 0
jbe 0x404989
mov eax, 0x47e218
call dword [0x47e234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4049e8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47b02c], 0
jne 0x4049dd
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405e74
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4060a4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405ef7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4060a4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405ef7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4060c0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405f80
xor eax, eax
push ebp
push 0x405f79
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405cb0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405f5e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4060e0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405f5e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f80
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40609a
cmp byte [ebp - 0xd], 0
jne 0x405fc7
cmp byte [ebp - 0x12], 0
je 0x40609a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405fe0
dec ebx
cmp byte [ebx], 0x2e
je 0x405fef
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405fdf
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40609a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40602c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40609a
cmp byte [ebp - 0xd], 0
je 0x40609a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40609a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4085fc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40864e
test eax, edx
je 0x408651
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x408611
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x408637
add ecx, 4
js 0x408627
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x408634
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x40865d
test edx, edx
jne 0x408604
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40bb28
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bb61
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404bd0
jmp 0x40bb6a
mov eax, ebx
mov edx, esi
call fcn.00404b34
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40bb74
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bb96
movzx eax, byte [esp]
jmp 0x40bb98
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c228
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c0a0
mov eax, dword [0x47d474]
cmp byte [eax], 0
je 0x40c2a4
mov eax, dword [0x47d280]
call fcn.0040320c
call fcn.00402fac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040919c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c2ec
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c2da
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x47d228]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4807f4]
call fcn.00405c58
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40cb64
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cc3a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404b78
lea eax, [ebp - 4]
call fcn.00404fc8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404f70
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40cc24
mov eax, ebx
call fcn.00402e50
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40cc1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404f70
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40cc07
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40cc4c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40cc07
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cc24
mov eax, dword [ebp - 0x10]
call fcn.00402e6c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cc41
lea eax, [ebp - 4]
call fcn.00404ae0
ret

Function at 0x41b8ac
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4829e8
cmp dword [edi], 0
jne 0x41b928
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4829e4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x47bb00
mov ecx, 2
call fcn.00403040
mov edx, 0x41b884
lea eax, [esi + 5]
call fcn.0041b8a4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041b8a4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41b8fd
mov dword [0x4829e4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41dec4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404f70
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x41df1c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x47d598]
mov dl, 1
mov eax, dword [0x41d9d0]
call fcn.0040c3e8
call fcn.00404528
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0041dad8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41f0ac
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41f0b2
ret
Function at 0x4365d0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404ae0
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43661e
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404d50
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43b700
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43b833
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x41da30]
call fcn.0041db00
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x43b809
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0041dba0
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.00404d50
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x43b848
call fcn.00404df8
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0041dc04
lea ecx, [ebp - 4]
mov edx, 0x43b884
mov eax, dword [ebp - 0xc]
call fcn.0041de4c
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040de18
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x43b7ec
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x43b890
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x47c540]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b7f3
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x43b8e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x43b927
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43b90a
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43b91b
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x43b927
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4408f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x482c40], 0
je 0x440a39
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x47d40c]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x440a39
mov eax, dword [0x482c44]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x482c40]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x440a08
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x482c40]
call fcn.00414940
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x440a00
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x440a00
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x440a00
mov eax, dword [ebp - 0x14]
call fcn.0044b1f0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x440a00
push ebp
call fcn.004408ac
pop ecx
test al, al
jne 0x440a00
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403eb0
test al, al
je 0x440a00
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403eb0
cmp byte [ebp - 1], 0
je 0x440a00
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x440a00
mov edx, dword [ebp - 0x14]
mov eax, dword [0x482c44]
call fcn.0044001c
inc edi
dec ebx
jne 0x440955
mov eax, dword [0x482c44]
cmp dword [eax + 8], 0
jle 0x440a20
mov eax, dword [0x482c44]
call fcn.004400d4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x440a39
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00440710
pop ecx
test al, al
jne 0x440a39
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret