joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cbec
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43cd1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x41c164]
call fcn.0041c234
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x43ccf5
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0041c2d4
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.00404b30
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x43cd34
call fcn.00404bd8
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0041c338
lea ecx, [ebp - 4]
mov edx, 0x43cd70
mov eax, dword [ebp - 0xc]
call fcn.0041c580
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040d93c
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x43ccd8
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x43cd7c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x4594d0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ccdf
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x43cdcc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x43ce13
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43cdf6
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43ce07
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x43ce13
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x441904
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x45ec70], 0
je 0x441a4d
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x45998c]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x441a4d
mov eax, dword [0x45ec74]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x45ec70]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x441a1c
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x45ec70]
call fcn.004143c0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x441a14
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x441a14
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x441a14
mov eax, dword [ebp - 0x14]
call fcn.0044bfc0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x441a14
push ebp
call fcn.004418c0
pop ecx
test al, al
jne 0x441a14
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403c20
test al, al
je 0x441a14
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403c20
cmp byte [ebp - 1], 0
je 0x441a14
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x441a14
mov edx, dword [ebp - 0x14]
mov eax, dword [0x45ec74]
call fcn.00441030
inc edi
dec ebx
jne 0x441969
mov eax, dword [0x45ec74]
cmp dword [eax + 8], 0
jle 0x441a34
mov eax, dword [0x45ec74]
call fcn.004410e8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x441a4d
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00441724
pop ecx
test al, al
jne 0x441a4d
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448e94
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0040677c
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00443c8c
test ebx, ebx
jne 0x448ee7
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00448dd0
mov ebx, eax
test ebx, ebx
je 0x448fd2
cmp esi, ebx
je 0x448f10
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x448f25
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x448f5d
add eax, 0xffffff5f
sub eax, 2
jb 0x448f75
dec eax
sub eax, 2
jb 0x448f89
dec eax
sub eax, 2
jb 0x448f7f
jmp 0x448f93
add eax, 0xfffffdff
sub eax, 2
jb 0x448f75
dec eax
sub eax, 2
jb 0x448f89
dec eax
sub eax, 2
jb 0x448f7f
jmp 0x448f93
mov byte [esp + 0x120], 0
jmp 0x448f9b
mov byte [esp + 0x120], 2
jmp 0x448f9b
mov byte [esp + 0x120], 1
jmp 0x448f9b
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0042a1cc
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.004453fc
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x448fd4
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x451128
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x459af8]
cmp byte [eax + 0xc], 0
je 0x451295
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45128e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x45ec80], 0
jne 0x45117c
push 0x45129c
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x4512a4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45ec80], eax
cmp dword [0x459618], 0
jne 0x451277
push 0x4512b4
call sub.kernel32.dll_LoadLibraryA
mov dword [0x459618], eax
cmp dword [0x459618], 0
je 0x451277
push 0x4512c0
mov eax, dword [0x459618]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45ec84], eax
push 0x4512d0
mov eax, dword [0x459618]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45ec88], eax
push 0x4512e4
mov eax, dword [0x459618]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45ec8c], eax
push 0x4512fc
mov eax, dword [0x459618]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45ec90], eax
push 0x451314
mov eax, dword [0x459618]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45ec94], eax
push 0x451328
mov eax, dword [0x459618]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45ec98], eax
push 0x451340
mov eax, dword [0x459618]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45ec9c], eax
push 0x451358
mov eax, dword [0x459618]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45eca0], eax
push 0x451374
mov eax, dword [0x459618]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45eca4], eax
push 0x451380
mov eax, dword [0x459618]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45eca8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451295
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x404c86
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x404cc5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404cc5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404cc5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404cc5
cmp dword [ecx + 0x74], 0xe
jbe 0x404cc5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40a78d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40a82a
push ebx
push esi
call fcn.0040a756
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040a69f
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40a7d7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a829
push edi
push eax
call fcn.0040916c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40a7f7
call fcn.004092c7
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a828
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040a69f
add esp, 0x20
test eax, eax
jne 0x40a816
push edi
call fcn.004092c7
jmp 0x40a81e
push ebx
call fcn.004092c7
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40b9f1
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x414620
push 0x414618
push str.FlsAlloc
push 0x1e
call fcn.0040b8b2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ba25
push dword [ebp + 8]
mov ecx, esi
call dword [0x41213c]
call esi
jmp 0x40ba2b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40ba6f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x414630
push 0x414628
push str.FlsGetValue
push 0x20
call fcn.0040b8b2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40baa6
push dword [ebp + 8]
mov ecx, esi
call dword [0x41213c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x410e90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x410ebd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x410ebd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..retplne
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x7d5a3402
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x31b0238d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4019e1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c420]
jne 0x4019eb
repz ret
jmp fcn.00401e83

Function at 0x40663b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40c420]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404530
and dword [ebp - 0x14], 0
cmp dword [0x5763fc], 0
mov dword [ebp - 0x18], eax
jne 0x4066ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406796
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406796
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x5763fc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x576400], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x576404], eax
call edi
push eax
call esi
mov dword [0x57640c], eax
test eax, eax
je 0x4066ee
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x576408], eax
mov eax, dword [0x576408]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406747
cmp dword [0x57640c], ecx
je 0x406747
push eax
call esi
push dword [0x57640c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406747
test ebx, ebx
je 0x406747
call edi
test eax, eax
je 0x40673e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40673e
test byte [ebp - 8], 1
jne 0x406747
or dword [ebp + 0x10], 0x200000
jmp 0x40677a
mov eax, dword [0x576400]
cmp eax, dword [ebp - 0x18]
je 0x40677a
push eax
call esi
test eax, eax
je 0x40677a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40677a
mov eax, dword [0x576404]
cmp eax, dword [ebp - 0x18]
je 0x40677a
push eax
call esi
test eax, eax
je 0x40677a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5763fc]
call esi
test eax, eax
je 0x406796
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406798
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004019e1
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x4552d8]
shl eax, 2
mov dword [0x4552dc], eax
push edi
push ecx
xor eax, eax
mov edi, 0x45a3d0
mov ecx, 0x45e4f8
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0044b66c
pop edx
call fcn.0044b5d0
call fcn.0044b6ac
push 0
call fcn.0044c85c
pop ecx
push 0x4552a0
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4552e0], eax
push 0
jmp fcn.00450168

Function at 0x409d98
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00449528
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x409df9
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x409df9
cmp byte [ebp - 0x102], 0
je 0x409df9
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00449754
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e498
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x40e49e
ret

Function at 0x41093c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41098d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x410974
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x410964
jmp 0x41098d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x410975
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4170a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x45a4b8
cmp dword [edi], 0
jne 0x41711c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x45a4b4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x45686c
mov ecx, 2
call fcn.004486d4
mov edx, 0x417078
lea eax, [esi + 5]
call fcn.00417098
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00417098
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4170f1
mov dword [0x45a4b4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x417238
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x417288]
test si, 4
je 0x41724c
or bl, 1
test si, 8
je 0x417256
or bl, 4
test si, 1
je 0x417260
or bl, 8
test si, 2
je 0x41726a
or bl, 0x10
test si, 0x10
je 0x417274
or bl, 0x20
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x417283
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x41728c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4172c4]
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4172a5
or bl, 1
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4172b4
or bl, 4
test esi, 0x20000000
je 0x4172bf
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x41d964
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41db09
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x439e1c]
call fcn.00448b68
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00449528
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.USER32.DLL_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x41dadf
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00430b44
test al, al
je 0x41dad2
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x41db18
lea eax, [ebp - 0x254]
call fcn.004441c8
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x41dad2
xor eax, eax
push ebp
push 0x41dacb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x41db50
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x41dab4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00449754
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x41dab4
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00449754
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dad2
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x41d9d5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0043d068
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41db10
lea eax, [ebp - 0x260]
call fcn.00449528
ret

Function at 0x41e2ac
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x45a480]
cmp byte [eax + 0x8d], 0
jne 0x41e31d
cmp dword [0x45a4c4], 0
jne 0x41e2de
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x41e268
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x45a4c4], eax
cmp dword [0x45a4c0], 0
jne 0x41e2f9
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x45a4c0], eax
cmp dword [0x45a4c8], 0
jne 0x41e31d
push esp
push 0
push 0
push 0x41e20c
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x45a4c8], eax
pop edx
ret