joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40288e
pop dword [ebp - 0x3c]
mov eax, 0xf3bc4204
add eax, 0xc83e68a
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xa0654c6d
add dword [ebp - 0x4c], 0xadecf8de
mov dword [ebp - 0x48], 0x147ec5b7
sub dword [ebp - 0x48], 0xe24b7972
mov dword [ebp - 0x44], 0xeb898ebb
sub dword [ebp - 0x44], 0x9f3d4a8d
mov dword [ebp - 0x40], 0x2b717c58
sub dword [ebp - 0x40], 0x2b717c58
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x2b91ace9
sub eax, 0x2b512c5d
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xea033456
add dword [ebp - 0x4c], 0x8a6f3500
mov dword [ebp - 0x48], 0xcd5c0a9d
add dword [ebp - 0x48], 0x741056d8
mov dword [ebp - 0x44], 0xef522fe3
sub dword [ebp - 0x44], 0x8be2c377
mov dword [ebp - 0x40], 0x56c6201b
add dword [ebp - 0x40], 0xa939dfe5
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x3032c4df
sub eax, 0x2ff2440b
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3979e
push 0
call eax
mov ecx, 0x6aa6c678
add ecx, 0x95598d0d
xor ebx, ebx
add ebx, eax
mov edi, 0x411000
add edi, dword [ebp - 0x3c]
mov edx, 0xa2ed397b
sub edx, 0xaa416216
sub dword [ebp - 0x28], ebx
mov esi, dword [edi]
add dword [ebp - 0x10], eax
add esi, edx
add dword [ebp - 0x10], 0xc30881d4
mov dword [ebx], esi
xor dword [ebp - 0xc], 0xceb5db3f
add ebx, 4
add edi, 4
loop 0x4029ac
add eax, 0x634664bb
add eax, 0x9cbadc2c
mov ebx, eax
add eax, 0xe91e7c21
add eax, 0x16e183e4
mov ecx, 0x61ddc375
sub ecx, 0x619dc375
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x628218d
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1c822d88
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4027c8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403a14
test esi, esi
jne 0x4027fe
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403b04
jmp 0x40281c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040267c
mov edi, eax
test esi, esi
je 0x40281c
cmp dword [ebx], 0
je 0x40281c
dec esi
jmp 0x402805
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402db8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x410014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402e50
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402e30
xor eax, eax
push ebp
push 0x402e29
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402e6c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e30
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x410014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x410014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403898
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x411044], 0
je 0x4038f9
cmp word [0x411218], 0xd7b2
jne 0x4038c1
cmp dword [0x411220], 0
jbe 0x4038c1
mov eax, 0x411214
call dword [0x411230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41005c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403920
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x410020], 0
jne 0x403915
push 0
push 0x410054
push 0x41005c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404458
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404688
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4044db
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404688
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4044db
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4046a4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404564
xor eax, eax
push ebp
push 0x40455d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004042a0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404542
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4046c4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404542
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404564
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40467e
cmp byte [ebp - 0xd], 0
jne 0x4045ab
cmp byte [ebp - 0x12], 0
je 0x40467e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4045c4
dec ebx
cmp byte [ebx], 0x2e
je 0x4045d3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4045c3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40467e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404610
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40467e
cmp byte [ebp - 0xd], 0
je 0x40467e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40467e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404848
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4048ae
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403c68
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402988
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404898
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4048b5
lea eax, [ebp - 0x10]
call fcn.00403a14
ret

Function at 0x406b94
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x406bc5
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x406bcc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x406bfd
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x407060
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403df0
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x407f30
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x407f78
mov ecx, dword [ebp - 0x10]
dec ecx
lea edx, [ebp - 0x110]
mov eax, dword [ebp + 8]
call fcn.00403b04
jmp 0x407f83
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00403a68
mov esp, ebp
pop ebp
ret 4

Function at 0x407f8c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x407fba
mov al, byte [ebp - 0xc]
mov byte [ebp - 0xa], al
jmp 0x407fc0
mov al, byte [ebp - 9]
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xa]
mov esp, ebp
pop ebp
ret
Function at 0x408748
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x400
lea ecx, [ebp - 0x44c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00408590
mov eax, dword [0x4109fc]
cmp byte [eax], 0
je 0x4087db
mov eax, dword [0x410954]
call fcn.00402894
call fcn.004025ec
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x44c]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x44c]
call fcn.0040708c
push eax
lea eax, [ebp - 0x44c]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 0xc]
push eax
push 2
push 0x408820
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x408811
push 0x40
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [0x410934]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x411660]
call fcn.00404264
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
mov esp, ebp
pop ebp
ret

Function at 0x4093e8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x409452
push dword fs:[eax]
mov dword fs:[eax], esp
push 7
lea eax, [ebp - 0xf]
push eax
push 0x1004
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xf]
mov ecx, 7
call fcn.00403c68
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040699c
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409459
lea eax, [ebp - 0x14]
call fcn.00403a14
ret
Function at 0x40f778
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x40f841
lea eax, [esp + 4]
push eax
push esi
call sub.user32.dll_GetClientRect
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 4]
mov edx, dword [esp + 0x10]
sub edx, dword [esp + 8]
mov dword [esp], edx
mov ebp, eax
sub ebp, 0xa
sub ebp, 0x20
sub ebp, 0xa
sub ebp, 0xa
mov ebx, 0x14
mov edi, 0x34
fild dword [esp]
fdiv dword [0x40f84c]
mov dword [esp + 0x14], ebx
fild dword [esp + 0x14]
fdiv dword [0x40f84c]
fsubp st(1)
call fcn.00402840
push edi
push eax
push ebp
push ebx
push esi
push 0
mov eax, dword [0x411660]
push eax
push 0
mov eax, 0x40f850
mov ecx, 0x44000000
xor edx, edx
call fcn.00405988
mov ebx, eax
test ebx, ebx
je 0x40f841
mov dx, 0x64
xor eax, eax
call fcn.00405958
push eax
push 0
push 0x401
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0xa
push 0x404
push ebx
call sub.user32.dll_SendMessageA
mov eax, dword [0x4109c4]
mov eax, dword [eax]
push eax
push ebx
call sub.user32.dll_ShowWindow
push ebx
call sub.user32.dll_UpdateWindow
mov eax, ebx
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405d40
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405d79
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004032d0
jmp 0x405d82
mov eax, ebx
mov edx, esi
call fcn.00403284
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405d8c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405dad
mov al, byte [esp]
jmp 0x405daf
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40e160
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004031f0
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x40e1c1
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x40e1c1
cmp byte [ebp - 0x102], 0
je 0x40e1c1
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.0040334c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f3f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x24], 0
je 0x40f475
xor eax, eax
mov al, byte [ebx + 4]
mov word [ebp - 6], ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x40f426
add word [ebp - 6], 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x40f438
add word [ebp - 6], 0x4000
test byte [ebx + 0xb], 0x20
je 0x40f444
add word [ebp - 6], 0x8000
xor ebx, ebx
movzx edx, word [ebp - 6]
mov cl, 2
mov eax, dword [ebp - 0xc]
call fcn.0040f2cc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40f469
push ebp
mov eax, dword [ebp - 4]
call fcn.0040f368
pop ecx
mov ebx, eax
cmp bl, 2
je 0x40f444
cmp dword [ebp - 4], 0
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417d38
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x417d3e
ret
Function at 0x41e2c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x42e64c
cmp dword [edi], 0
jne 0x41e33c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x42e648]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x42d544
mov ecx, 2
call fcn.004026d8
mov edx, 0x41e298
lea eax, [esi + 5]
call fcn.0041e2b8
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041e2b8
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41e311
mov dword [0x42e648], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41e440
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41e490]
test si, 4
je 0x41e454
or bl, 1
test si, 8
je 0x41e45e
or bl, 4
test si, 1
je 0x41e468
or bl, 8
test si, 2
je 0x41e472
or bl, 0x10
test si, 0x10
je 0x41e47c
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41e48b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x41e494
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41e4cc]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41e4ad
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41e4bc
or bl, 4
test esi, 0x20000000
je 0x41e4c7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x42235c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x42e624]
cmp byte [eax + 0x7f], 0
jne 0x4223af
cmp dword [0x42e650], 0
jne 0x42238b
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, 0x422318
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x42e650], eax
cmp dword [0x42e654], 0
jne 0x4223af
push esp
push 0
push 0
push 0x4222c8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x42e654], eax
pop edx
ret

Function at 0x4223b4
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x42e650], 0
je 0x4223c8
mov eax, dword [0x42e650]
push eax
call sub.user32.dll_UnhookWindowsHookEx
xor eax, eax
mov dword [0x42e650], eax
cmp dword [0x42e654], 0
je 0x4223e5
push 0
mov eax, dword [0x42e654]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
mov dword [0x42e654], eax
ret
Function at 0x422484
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x42249b
add esp, 0xfffffff0
call fcn.00402b3c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0040d268
mov dl, 1
mov eax, 0x407990
call fcn.0040293c
mov dword [ebx + 0x70], eax
mov dl, 1
mov eax, 0x407990
call fcn.0040293c
mov dword [ebx + 0x80], eax
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x3c], 0x80000018
mov dword [ebx + 0x54], 0x1f4
mov dword [ebx + 0x58], 0x32
mov dword [ebx + 0x5c], 0x9c4
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x7d], 1
mov dl, 1
mov eax, 0x417c30
call fcn.0041c944
mov esi, eax
mov dword [ebx + 0x78], esi
push 0x4225dc
mov eax, dword [0x42e014]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041ccd0
mov eax, dword [ebx + 0x78]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x42388c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x42e014]
push eax
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.004058a8
test eax, eax
je 0x422578
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004057bc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.00405888
test eax, eax
je 0x42258c
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x6c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040334c
cmp byte [0x42e034], 0
jne 0x4225bc
mov eax, ebx
call fcn.0042266c
mov byte [ebx + 0x39], 1
mov byte [ebx + 0x3a], 1
cmp byte [ebp - 1], 0
je 0x4225d4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x423074
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x7e], 0
je 0x4230a6
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x20]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004032d0
jmp 0x4230b0
mov eax, esi
mov edx, dword [ebx + 0x6c]
call fcn.00403284
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x423a64
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x60]
test esi, esi
je 0x423a9c
mov eax, esi
call fcn.0041569c
test al, al
je 0x423a9c
mov eax, dword [ebx + 0x60]
call fcn.00415504
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x423a9c
push 0
mov eax, dword [ebx + 0x60]
call fcn.00415504
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret