joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4328a3
Capabilities:
Parse credit card information

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x30]
mov eax, dword [edi]
mov dword [esp + 0x10], ecx
cmp byte [ecx], 0x28
mov ebp, eax
mov dword [esp + 0x30], ebp
mov dword [esp + 0x14], 0
jne 0x4329e1
mov dl, byte [ecx + 1]
cmp dl, 0x3f
jne 0x432bc7
cmp byte [ecx + 2], 0x7c
jne 0x432bbe
add ecx, 3
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 1
jmp 0x4329e1
cmp byte [ecx + 2], 0x28
jne 0x432952
add ecx, 2
mov dword [esp + 0x10], ecx
cmp byte [ecx + 1], 0x3f
je 0x4329e1
mov al, byte [ecx]
test al, al
je 0x432932
add ecx, 2
mov dword [esp + 0x10], ecx
cmp byte [ecx], 0x50
jne 0x432963
inc ecx
mov dword [esp + 0x10], ecx
mov dl, byte [ecx]
cmp dl, 0x3c
jne 0x432977
mov bl, byte [ecx + 1]
cmp bl, 0x21
je 0x432977
cmp bl, 0x3d
jne 0x43297c
cmp dl, 0x27
jne 0x4329e1
inc eax
mov dword [edi], eax
test esi, esi
jne 0x43298d
cmp eax, dword [esp + 0x28]
je 0x432be5
movzx eax, byte [ecx]
inc ecx
mov dword [esp + 0x10], ecx
cmp eax, 0x3c
jne 0x43299f
mov eax, 0x3e
movzx ebx, byte [ecx]
mov edx, ecx
cmp ebx, eax
je 0x4329b4
inc ecx
mov dword [esp + 0x10], ecx
movzx ebx, byte [ecx]
cmp ebx, eax
jne 0x4329a8
test esi, esi
je 0x4329e1
mov eax, dword [esp + 0x28]
mov ebx, ecx
sub ebx, edx
cmp eax, ebx
jne 0x4329e1
push eax
push edx
push esi
call fcn.00416685
add esp, 0xc
test eax, eax
jne 0x4329dd
mov eax, dword [edi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x10]
cmp dl, 0x3f
je 0x4328ff
cmp dl, 0x2a
je 0x4328ff
inc eax
mov dword [edi], eax
test esi, esi
jne 0x432948
cmp eax, dword [esp + 0x28]
jne 0x432948
Function at 0x434506
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
mov esi, dword [esp + 0x58]
and al, 0x58
mov eax, dword [esi + 8]
mov ecx, dword [esi]
mov ebp, dword [esi + 4]
cmp eax, ecx
push edi
mov edi, dword [esi + 0xc]
setl dl
cmp edi, ebp
setl bl
mov byte [esp + 0x5c], dl
mov byte [esp + 0x13], bl
test dl, dl
je 0x434537
mov dword [esi], eax
mov dword [esi + 8], ecx
test bl, bl
je 0x434541
mov dword [esi + 4], edi
mov dword [esi + 0xc], ebp
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [edx + 0x104]
lea ecx, [esp + 0x20]
push ecx
push eax
call fcn.004344b7
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add dword [esi], eax
add dword [esi + 8], eax
mov edx, dword [esi]
mov edi, dword [esi + 8]
add dword [esi + 4], ecx
add dword [esi + 0xc], ecx
mov ebx, dword [esi + 4]
mov ebp, dword [esi + 0xc]
sub edi, edx
inc edi
sub ebp, ebx
push 0
mov dword [esp + 0x5c], edi
inc ebp
call dword [sym.imp.USER32.dll_GetDC]
push ebp
mov ebx, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x14]
mov edi, eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dl, byte [esp + 0x13]
mov dword [esp + 0x18], eax
mov ecx, ebp
test dl, dl
je 0x4345bf
neg ecx
cmp byte [esp + 0x5c], 0
mov eax, dword [esp + 0x58]
je 0x4345cc
neg eax
test dl, dl
je 0x4345d5
mov edx, dword [esi + 0xc]
jmp 0x4345d8
mov edx, dword [esi + 4]
cmp byte [esp + 0x5c], 0
mov dword [esp + 0x54], edx
je 0x4345fd
mov esi, dword [esi + 8]
jmp 0x4345ff
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.004112ef
add esp, 4
xor eax, eax
add esp, 0x40
ret 0x10
mov esi, dword [esi]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x60]
push eax
push esi
push ebx
push ebp
push ecx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
mov edx, dword [esp + 0x58]
mov esi, dword [esp + 0x14]
push 0
mov eax, ebp
neg eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
mov dword [esp + 0x3c], edx
push esi
mov ecx, 1
mov edx, 0x20
push edi
mov dword [esp + 0x40], 0x28
mov word [esp + 0x4c], cx
mov word [esp + 0x4e], dx
mov dword [esp + 0x50], 0
call dword [sym.imp.GDI32.dll_GetDIBits]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x60]
push eax
mov dword [ecx], eax
call fcn.0041171a
add esp, 4
push 0
lea edx, [esp + 0x28]
push edx
push eax
push ebp
push 0
push esi
push edi
mov dword [esp + 0x78], eax
call dword [sym.imp.GDI32.dll_GetDIBits]
mov ebp, eax
mov eax, dword [esp + 0x18]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
test ebp, ebp
pop ebp
pop ebx
je 0x4345e8
mov eax, dword [esp + 0x4c]
add esp, 0x40
ret 0x10
Function at 0x4346d0
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
lea ebx, [ecx + edx]
mov edx, edi
imul edx, esi
add edx, edx
add esi, esi
or eax, 0xffffffff
add edx, edx
add esi, esi
lea edi, [ecx + edi*4]
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edi
mov esi, ecx
movzx ebp, byte [ecx + 2]
add ecx, 2
mov edi, eax
and edi, 0xff
xor edi, ebp
movzx ebp, byte [ecx - 1]
shr eax, 8
xor eax, dword [edi*4 + 0x491dc8]
dec ecx
mov edi, eax
and edi, 0xff
xor edi, ebp
movzx ebp, byte [ecx - 1]
shr eax, 8
xor eax, dword [edi*4 + 0x491dc8]
dec ecx
mov edi, eax
and edi, 0xff
xor edi, ebp
shr eax, 8
xor eax, dword [edi*4 + 0x491dc8]
add ecx, edx
cmp ecx, ebx
jb 0x43475d
add esi, dword [esp + 0x20]
mov ecx, esi
cmp esi, dword [esp + 0x1c]
jb 0x434704
not eax
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
test eax, eax
jge 0x434777
fadd qword [0x48c528]
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x434bee
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [esp + 0x10]
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 8]
push eax
push ecx
xor bl, bl
call edi
Function at 0x434c14
Capabilities:
Enumerate files on windows
Get file attributes
Set current directory
Set file attributes

Disassembly:
mov esi, eax
cmp esi, 0xffffffff
je 0x434c81
lea ecx, [ecx]
lea edx, [esp + 0x3c]
push 0x48724c
push edx
call fcn.004133e4
add esp, 8
test eax, eax
je 0x434c71
lea eax, [esp + 0x3c]
push 0x48a090
push eax
call fcn.004133e4
add esp, 8
test eax, eax
je 0x434c71
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
not edx
and eax, edx
push eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x434c9b
mov bl, 1
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x434c1e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
call esi
cmp byte [ebp + 0x14], 0
jne 0x434cad
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0x10]
push edx
push str.._b
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x434d34
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test byte [esp + 0x10], 0x10
je 0x434d24
lea eax, [esp + 0x3c]
push 0x48724c
push eax
call fcn.004133e4
add esp, 8
test eax, eax
je 0x434d24
lea ecx, [esp + 0x3c]
push 0x48a090
push ecx
call fcn.004133e4
add esp, 8
test eax, eax
je 0x434d24
lea edx, [esp + 0x3c]
push edx
call ebx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
call fcn.00434bee
test al, al
je 0x434d42
push 0x48a090
call ebx
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x434cc6
push edi
call esi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push edi
call esi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x436582
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x29c
push esi
mov esi, dword [esp + 0x2a4]
push edi
mov edi, dword [esp + 0x2ac]
lea eax, [esp + 0x110]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x436660
push 0x100
lea ecx, [esp + 0x14]
push ecx
call sub.WSOCK32.dll_gethostname
lea edx, [esp + 0x10]
push edx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x436660
mov eax, dword [eax + 0xc]
xor edx, edx
cmp dword [eax], edx
je 0x4365eb
mov ecx, eax
lea esp, [esp]
add ecx, 4
inc edx
cmp dword [ecx], 0
jne 0x4365e2
cmp esi, edx
jle 0x43660b
push 0x487258
push edi
call fcn.00411691
add esp, 8
call sub.WSOCK32.dll_WSACleanup
pop edi
pop esi
add esp, 0x29c
ret
mov eax, dword [eax + esi*4 - 4]
push 4
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00410f70
mov edx, dword [esp + 0x18]
add esp, 0xc
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00413990
lea ecx, [esp + 0x18]
push 0xffffffffffffffff
push ecx
call fcn.004359c4
mov esi, eax
push esi
push edi
call fcn.00411691
push esi
call fcn.004112ef
add esp, 0x1c
call sub.WSOCK32.dll_WSACleanup
pop edi
pop esi
add esp, 0x29c
ret
push 0x4848e8
push edi
call fcn.00411691
add esp, 8
pop edi
pop esi
add esp, 0x29c
ret

Function at 0x4366be
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x20c
push 0x104
push eax
lea ecx, [esp + 8]
push ecx
call fcn.00436328
lea edx, [esp + 0xc]
push edx
call fcn.004112d5
add esp, 0x10
test eax, eax
je 0x4366fa
cmp word [esp + eax*2 - 2], 0x5c
lea eax, [esp + eax*2 - 2]
jne 0x4366fa
xor ecx, ecx
mov word [eax], cx
push ebp
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4367a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test al, 0x10
jne 0x43672d

Function at 0x436ac4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436adb
test al, 0x10
je 0x436adb
mov al, 1
ret
xor al, al
ret

Function at 0x436ade
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x436b1d
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x436b12
or eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x436b3a
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x18]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x436b62
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x10
ret
push ebp
push esi
call fcn.0041171a
add esp, 4
mov ebp, eax
push ebp
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push edi
call fcn.004112d5
xor ecx, ecx
add eax, 0x1a
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov esi, eax
push 0x484e10
push esi
call fcn.00411691
push 0x484e10
push edi
call fcn.004133e4
add esp, 0x18
test eax, eax
je 0x436c45
push 0x487198
push esi
call fcn.00411663
push 0x484e10
push edi
call fcn.00413772
add esp, 0x10
test eax, eax
jne 0x436c3b
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x4871b8
push ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x436c16
mov edx, dword [esp + 0x14]
mov ebx, dword [edx]
push 4
lea eax, [esi + 0x20]
push eax
push ebx
call fcn.00435eed
push 4
lea ecx, [esi + 0x28]
push ecx
shr ebx, 0x10
push ebx
call fcn.00435eed
add esp, 0x18
jmp 0x436c24
push 0x4871ec
push esi
call fcn.00411663
add esp, 8
push 0x484e10
push esi
call fcn.00411663
push edi
push esi
call fcn.00411663
add esp, 0x10
jmp 0x436c45
push edi
push esi
call fcn.00411663
add esp, 8
push str.Defa
push edi
call fcn.004115d0
add esp, 8
test eax, eax
jne 0x436c86
mov edi, dword [esp + 0x28]
push 8
lea edx, [esi + 0x20]
push edx
push edi
call fcn.0041326a
xor eax, eax
push ebp
mov word [edi + 0x10], ax
call fcn.004112ef
push esi
call fcn.004112ef
add esp, 0x14
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x10
ret
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push esi
push ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x436d14
push 0x484e10
push edi
call fcn.004133e4
add esp, 8
test eax, eax
jne 0x436cdb
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
movzx edx, cx
push edx
mov edx, dword [esp + 0x2c]
shr ecx, 0x10
push ecx
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push 0x487228
push edx
call fcn.0041353a
add esp, 0x18
jmp 0x436cfb
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x28]
push 0x200
push eax
push edi
call fcn.0041326a
add esp, 0xc
xor ecx, ecx
mov word [edi + 0x400], cx
push ebp
call fcn.004112ef
push esi
call fcn.004112ef
add esp, 8
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x10
ret
push ebp
call fcn.004112ef
push esi
call fcn.004112ef
add esp, 8
pop ebp
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x10
ret
Function at 0x437118
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push 0
push 0

Function at 0x437124
Capabilities:
Terminate process

Disassembly:
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [esp + 8]
push eax
push 0x1f4
push 2
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x43717a
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 4]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 8
ret

Function at 0x4375b0
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ecx
push ebp
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, dword [esp + 0x10]
mov esi, eax
cmp ebp, esi
jne 0x4375ce
pop esi
mov eax, 1
pop ebp
pop ecx
ret 4
test esi, esi
jne 0x4375e0
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push ebp
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4375f4
push 9
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push ebp
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x4376e7
push ebx
push edi
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebp
mov ebx, eax
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
mov ebp, eax
push ebp
push ebx
call esi
push 1
push edi
push ebx
call esi
push 1
push ebp
push edi
call esi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x4376c1
push eax
push eax
push eax
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x4376c9
mov dword [esp + 0x10], 4
jmp 0x4376c9
mov dword [esp + 0x10], 3
push 0
push ebp
push ebx
call esi
push 0
push edi
push ebx
call esi
push 0
push ebp
push edi
call esi
mov eax, dword [esp + 0x10]
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret 4
pop esi
mov eax, 2
pop ebp
pop ecx
ret 4
Function at 0x4376ba
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ebp
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, dword [esp + 0x10]
mov esi, eax
cmp ebp, esi
jne 0x4375ce
pop esi
mov eax, 1
pop ebp
pop ecx
ret 4
test esi, esi
jne 0x4375e0
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push ebp
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4375f4
push 9
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push ebp
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x4376e7
push ebx
push edi
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebp
mov ebx, eax
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
mov ebp, eax
push ebp
push ebx
call esi
push 1
push edi
push ebx
call esi
push 1
push ebp
push edi
call esi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x4376c1
push eax
push eax
push eax
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x4376c9
mov dword [esp + 0x10], 4
jmp 0x4376c9
mov dword [esp + 0x10], 3
push 0
push ebp
push ebx
call esi
push 0
push edi
push ebx
call esi
push 0
push ebp
push edi
call esi
mov eax, dword [esp + 0x10]
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret 4
pop esi
mov eax, 2
pop ebp
pop ecx
ret 4
Function at 0x4377b4
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ebx
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
cmp edi, ebx
jne 0x4377ce
mov eax, dword [esp + 0x10]
cmp byte [eax + 9], bl
je 0x4378af
push esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
cmp byte [esp + 0x1c], bl
je 0x43787b
push ebp
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call ebp
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push esi
mov dword [0x4a9358], eax
call ebx
mov dword [esp + 0x20], eax
test edi, edi
je 0x437841
lea ecx, [esp + 0x10]
push ecx
push edi
call ebp
mov ecx, dword [0x4a9358]
mov dword [0x4a9354], eax
cmp ecx, eax
je 0x437839
push 1
push eax
push ecx
call ebx
mov dword [esp + 0x1c], eax
mov eax, dword [0x4a9354]
push 1
push eax
push esi
call ebx
jmp 0x437845
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x20], 0
pop ebp
jne 0x4378ae
cmp dword [esp + 0x18], 0
jne 0x4378ae
test eax, eax
jne 0x4378ae
mov eax, dword [0x4a9358]
cmp esi, eax
jne 0x4378ae
cmp eax, dword [0x4a9354]
jne 0x4378ae
mov edx, dword [esp + 0x14]
pop esi
pop edi
mov dword [edx + 0x20], 0
pop ebx
pop ecx
ret 0xc
cmp edi, ebx
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
je 0x4378a3
mov eax, dword [0x4a9354]
push ebx
push eax
push esi
call edi
mov ecx, dword [0x4a9358]
mov eax, dword [0x4a9354]
cmp ecx, eax
je 0x4378a3
push ebx
push eax
push ecx
call edi
mov ecx, dword [0x4a9358]
push ebx
push ecx
push esi
call edi
pop esi
pop edi
pop ebx
pop ecx
ret 0xc

Function at 0x43797b
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
movzx edi, byte [esp + 0x14]
push edi
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bl, 1
cmp byte [esp + 0x18], bl
je 0x4379d4
push ebp
mov ebp, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0
push edi
call ebp
push eax
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.004378b5
push esi
call fcn.0043792a
push 2
push 0
push edi
call ebp
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push esi
call fcn.004378b5
push esi
call fcn.00437953
pop ebp
pop edi
pop esi
mov al, bl
pop ebx
ret 0xc

Function at 0x4388ba
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esp + 8], 0
mov eax, dword [esp + 4]
je 0x4388d5
mov eax, dword [eax]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
ret 8
mov ecx, dword [eax]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
ret 8

Function at 0x4389b2
Capabilities:
Log keystrokes

Disassembly:
push 0x1388
push 2
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x4389e7
push 1
jmp 0x4389d0
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
ret 8
Function at 0x43905c
Capabilities:
Get token privileges

Disassembly:
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
push esi
push 0
push eax
push 3
push edi
call ebx
test eax, eax
jne 0x4390ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4390b9
mov ecx, dword [esi]
push ecx
call fcn.00438fcf
add esp, 4
mov dword [ebp], eax
test eax, eax
je 0x4390b9
mov edx, dword [esi]
push esi
push edx
push eax
push 3
push edi
call ebx
test eax, eax
je 0x4390b9
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
Function at 0x4422b9
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x224
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
mov esi, dword [esp + 0x234]
push edi
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x44]
push edx
push 0
push esi
mov dword [esp + 0x30], 0xff
call ebp
cmp eax, 0x103
je 0x4423cd
mov edi, dword [esp + 0x23c]
mov eax, edi
or eax, 0x20019
mov dword [esp + 0x18], eax
jmp 0x44231d
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push eax
push 0
lea edx, [esp + 0x3c]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4423e4
mov eax, dword [esp + 0x14]
push edi
push eax
call fcn.004422b9
mov ecx, dword [esp + 0x1c]
add esp, 8
push ecx
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x4423e4
lea edx, [esp + 0x1c]
xor ebx, ebx
push edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
call fcn.00434153
test al, al
je 0x44238a
push ebx
push edi
lea eax, [esp + 0x38]
push eax
push esi
lea ecx, [esp + 0x2c]
push ecx
call fcn.0044229a
call eax
jmp 0x442396
lea edx, [esp + 0x30]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, ebx
jne 0x4423da
lea eax, [esp + 0x1c]
push eax
call fcn.004344a0
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x44]
push eax
push ebx
push esi
mov dword [esp + 0x30], 0xff
call ebp
cmp eax, 0x103
jne 0x442319
invalid