joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc16c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4ef0f8], 0
jne 0x4bc1ed
cmp dword [0x4ef118], 0
jne 0x4bc19c
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4ef118], eax
test eax, eax
jne 0x4bc19c
push str.GetEnvironmentStrings_failed
call fcn.004bb988
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4ef118]
jmp 0x4bc1b0
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004b55e8
pop ecx
mov edi, eax
test eax, eax
jne 0x4bc1a8
lea edi, [ebp + 1]
push edi
call fcn.004b5048
pop ecx
mov ebx, eax
mov dword [0x4ef0fc], ebx
test ebx, ebx
jne 0x4bc1da
xor eax, eax
jmp 0x4bc2b0
push edi
mov edx, dword [0x4ef118]
push edx
push ebx
call fcn.004b5498
add esp, 0xc
jmp 0x4bc20d
xor esi, esi
mov ebx, dword [0x4ef0f8]
jmp 0x4bc207
push eax
call fcn.004b55e8
pop ecx
test eax, eax
jne 0x4bc203
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4bc1f7
lea ebx, [esi + 4]
push 4
mov dword [0x4ef100], ebx
inc ebx
push ebx
call fcn.004b4968
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4bc230
xor eax, eax
jmp 0x4bc2b0
cmp dword [0x4ef0f8], 0
jne 0x4bc261
xor esi, esi
mov ebx, dword [0x4ef0fc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4bc252
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004b55e8
pop ecx
mov edi, eax
test eax, eax
jne 0x4bc248
jmp 0x4bc292
xor esi, esi
mov ebx, dword [0x4ef0f8]
mov eax, dword [esp]
mov edi, eax
jmp 0x4bc28c
push eax
call fcn.004b55e8
pop ecx
test eax, eax
je 0x4bc281
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4bc285
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4bc270
mov eax, dword [0x4ef0f8]
test eax, eax
je 0x4bc2a2
push eax
call fcn.004b5058
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4ef0f8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3d121241
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x296651ac
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40611c
pop dword [ebp - 0xc]
mov eax, 0xf3955d26
add eax, 0xcab03f6
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xd1409ab
add dword [ebp - 0x1c], 0x413e3ba0
mov dword [ebp - 0x18], 0xdc778c7b
sub dword [ebp - 0x18], 0xaa444036
mov dword [ebp - 0x14], 0x8b4d456
sub dword [ebp - 0x14], 0xbc689028
mov dword [ebp - 0x10], 0x2e3266d7
sub dword [ebp - 0x10], 0x2e3266d7
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xae8fea86
add eax, 0x51b085da
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x70a124c9
add dword [ebp - 0x1c], 0x3d1448d
mov dword [ebp - 0x18], 0x449facc6
add dword [ebp - 0x18], 0xfcccb4af
mov dword [ebp - 0x14], 0x7abd124
sub dword [ebp - 0x14], 0xa43c64b8
mov dword [ebp - 0x10], 0x7479fa72
sub dword [ebp - 0x10], 0x7479fa72
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xcf3bc490
add eax, 0x3104ac70
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3837b
push 0
call eax
mov ecx, 0xc3581089
sub ecx, 0xc357c219
xor esi, esi
add esi, eax
mov edi, 0x33839d8b
add edi, 0xccbd6275
add edi, dword [ebp - 0xc]
mov edx, 0xfed02ec3
mov ebx, dword [edi]
mov dword [ebp - 8], 0xe3420eec
sub ebx, edx
sub dword [ebp - 8], 0x82e15ac3
mov dword [esi], ebx
xor dword [ebp - 4], 0x2ffea25
add esi, 0x4c8d028
sub esi, 0x4c8d024
add edi, 4
loop 0x40623a
add eax, 0x18117da
add eax, 0xfe8014b9
xor ebx, ebx
add ebx, eax
add eax, 0x7e079071
add eax, 0x81f86f94
mov ecx, 0xa17c7f0a
sub ecx, 0xa13c7f0a
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x40351c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404d24
test esi, esi
jne 0x403552
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404e14
jmp 0x403570
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403420
mov edi, eax
test esi, esi
je 0x403570
cmp dword [ebx], 0
je 0x403570
dec esi
jmp 0x403559
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4035a4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x48b008], 0x8088405
inc edx
mov dword [ebx + 0x48b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403cf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x48b024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403d88
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403d68
xor eax, eax
push ebp
push 0x403d61
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403da4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403d68
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x48b024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x48b024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404ba4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48e04c], 0
je 0x404c05
cmp word [0x48e220], 0xd7b2
jne 0x404bcd
cmp dword [0x48e228], 0
jbe 0x404bcd
mov eax, 0x48e21c
call dword [0x48e238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404c2c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x48b034], 0
jne 0x404c21
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4063a0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4065d0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406423
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4065d0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406423
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4065ec
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4064ac
xor eax, eax
push ebp
push 0x4064a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004061dc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40648a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40660c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40648a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4064ac
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4065c6
cmp byte [ebp - 0xd], 0
jne 0x4064f3
cmp byte [ebp - 0x12], 0
je 0x4065c6
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40650c
dec ebx
cmp byte [ebx], 0x2e
je 0x40651b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40650b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4065c6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406558
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4065c6
cmp byte [ebp - 0xd], 0
je 0x4065c6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4065c6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b068
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40b0ba
test eax, edx
je 0x40b0bd
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x40b07d
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40b0a3
add ecx, 4
js 0x40b093
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x40b0a0
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x40b0c9
test edx, edx
jne 0x40b070
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40ba68
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004051b4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40ba81
test al, 0x10
je 0x40ba85
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40e704
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40e73d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404e14
jmp 0x40e746
mov eax, ebx
mov edx, esi
call fcn.00404d78
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40e750
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40e772
movzx eax, byte [esp]
jmp 0x40e774
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ee04
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ec7c
mov eax, dword [0x48d9d8]
cmp byte [eax], 0
je 0x40ee80
mov eax, dword [0x48d720]
call fcn.00403678
call fcn.0040328c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040bc78
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40eec8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40eeb6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x48d6b8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4907f8]
call fcn.00406184
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40f788
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40f85e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404dbc
lea eax, [ebp - 4]
call fcn.0040520c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004051b4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40f848
mov eax, ebx
call fcn.004030c0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40f841
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004051b4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40f82b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40f870
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40f82b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f848
mov eax, dword [ebp - 0x10]
call fcn.004030dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f865
lea eax, [ebp - 4]
call fcn.00404d24
ret

Function at 0x421c68
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x494c28
cmp dword [edi], 0
jne 0x421ce4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x494c24]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x48c26c
mov ecx, 2
call fcn.00403320
mov edx, 0x421c40
lea eax, [esi + 5]
call fcn.00421c60
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00421c60
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x421cb9
mov dword [0x494c24], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42550c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004051b4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x425564
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x48db68]
mov dl, 1
mov eax, dword [0x425018]
call fcn.0040efc4
call fcn.0040476c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00425120
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4266f4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4266fa
ret
Function at 0x43aaac
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404d24
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43aafa
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404f94
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43fbdc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43fd0f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x425078]
call fcn.00425148
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x43fce5
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004251e8
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.00404f94
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x43fd24
call fcn.0040503c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0042524c
lea ecx, [ebp - 4]
mov edx, 0x43fd60
mov eax, dword [ebp - 0xc]
call fcn.00425494
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00410ad0
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x43fcc8
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x43fd6c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x48cc38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fccf
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x43fdbc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x43fe03
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43fde6
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43fdf7
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x43fe03
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x444c3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x494e88], 0
je 0x444d85
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x48d948]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x444d85
mov eax, dword [0x494e8c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x494e88]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x444d54
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x494e88]
call fcn.0041aa30
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x444d4c
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x444d4c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x444d4c
mov eax, dword [ebp - 0x14]
call fcn.0044f53c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x444d4c
push ebp
call fcn.00444bf8
pop ecx
test al, al
jne 0x444d4c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.004040f4
test al, al
je 0x444d4c
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.004040f4
cmp byte [ebp - 1], 0
je 0x444d4c
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x444d4c
mov edx, dword [ebp - 0x14]
mov eax, dword [0x494e8c]
call fcn.00444368
inc edi
dec ebx
jne 0x444ca1
mov eax, dword [0x494e8c]
cmp dword [eax + 8], 0
jle 0x444d6c
mov eax, dword [0x494e8c]
call fcn.00444420
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x444d85
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00444a5c
pop ecx
test al, al
jne 0x444d85
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c410
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00406e9c
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00446fc4
test ebx, ebx
jne 0x44c463
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0044c34c
mov ebx, eax
test ebx, ebx
je 0x44c54e
cmp esi, ebx
je 0x44c48c
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x44c4a1
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x44c4d9
add eax, 0xffffff5f
sub eax, 2
jb 0x44c4f1
dec eax
sub eax, 2
jb 0x44c505
dec eax
sub eax, 2
jb 0x44c4fb
jmp 0x44c50f
add eax, 0xfffffdff
sub eax, 2
jb 0x44c4f1
dec eax
sub eax, 2
jb 0x44c505
dec eax
sub eax, 2
jb 0x44c4fb
jmp 0x44c50f
mov byte [esp + 0x120], 0
jmp 0x44c517
mov byte [esp + 0x120], 2
jmp 0x44c517
mov byte [esp + 0x120], 1
jmp 0x44c517
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0045afec
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0044877c
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x44c550
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret