joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4123d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov bl, byte [ebp + 0xc]
mov bh, cl
or byte [ebp + 8], bl
mov al, bh
dec al
mov dword [esp + 8], edx
push esi
push edi
cmp al, 5
ja 0x4123f5
cmp bh, 3
jne 0x4123fd
mov al, bh
add al, 0x66
cmp al, 5
ja 0x412404
mov byte [esp + 0xf], 1
jmp 0x412409
mov byte [esp + 0xf], 0
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x1c]
test esi, esi
jle 0x41253c
mov bl, byte [esp + 0xf]
nop dword [eax + eax]
cmp dword [0x4cd100], 0
jne 0x412486
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4c8024]
sub eax, dword [0x4cce94]
cmp eax, dword [ecx + 0xb8]
jbe 0x41248c
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x41247b
mov edx, 1
mov dword [0x4c801c], 0
or ecx, 0xffffffff
call fcn.00401730
mov dword [0x4c801c], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4cce94], eax
mov ecx, dword [0x4c8024]
cmp byte [ebp + 0x18], 0
jne 0x4124e0
mov al, byte [ecx + 0xd6]
test al, al
je 0x4124a8
movzx eax, al
mov esi, 0xffc3d44d
sub esi, eax
jmp 0x4124ad
mov esi, 0xffc3d44f
cmp dword [0x4cd100], 0
je 0x4124bd
mov al, byte [0x4cd0f4]
jmp 0x4124c4
xor cl, cl
call fcn.004154e0
mov cl, byte [ebp + 8]
mov dl, al
push esi
push 1
push 0
push edi
call fcn.00414db0
mov ecx, dword [0x4c8024]
add esp, 0x10
mov esi, dword [ebp + 0x10]
test bl, bl
je 0x41250a
test edi, edi
jne 0x41250a
push dword [ebp + 0x28]
movzx eax, byte [ecx + 0xcf]
mov cl, bh
push dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
push eax
push 1
push dword [ebp + 0x24]
call fcn.00413bb0
add esp, 0x14
jmp 0x41252d
movzx eax, byte [ecx + 0xd6]
mov dl, bh
mov ecx, 0xffc3d44d
sub ecx, eax
push ecx
mov ecx, dword [ebp + 0x14]
push 1
push edi
push dword [esp + 0x1c]
call fcn.00412a10
add esp, 0x10
sub esi, 1
mov dword [ebp + 0x10], esi
jne 0x412420
mov bl, byte [ebp + 0xc]
cmp byte [ebp + 0x18], 0
jne 0x412578
cmp dword [0x4cd100], 0
je 0x412552
mov al, byte [0x4cd0f4]
jmp 0x412559
xor cl, cl
call fcn.004154e0
not bl
and bl, al
and bl, 0xcc
je 0x412578
push 0xffc3d44d
push 0
push 1
push edi
mov dl, bl
xor cl, cl
call fcn.00414db0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412580
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x34
cmp dword [0x4cd100], 2
push ebx
mov bl, cl
sete bh
push esi
mov esi, edx
mov byte [esp + 8], bl
jne 0x4125cc
movzx eax, byte [esp + 0x10]
and cl, 0x80
mov edx, 0x30
cmovne eax, edx
lea edx, [esp + 0x11]
mov byte [esp + 0x10], al
test cl, cl
lea eax, [esp + 0x10]
cmovne eax, edx
push 0xa
push eax
movzx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
add esp, 0xc
jmp 0x4125ec
push 1
lea eax, [esp + 0x10]
push eax
push 1
lea eax, [esp + 0x14]
push eax
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4126a0
test esi, esi
jle 0x4126a0
mov bl, byte [esp + 0x40]
push ebp
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x4cd100], 0
jne 0x412660
call edi
mov ecx, dword [0x4c8024]
sub eax, dword [0x4cce94]
cmp eax, dword [ecx + 0xb8]
jbe 0x412660
push 0
push 0
push 0
push 0
lea eax, [esp + 0x38]
push eax
call ebp
test eax, eax
je 0x412659
mov edx, 1
mov dword [0x4c801c], 0
or ecx, 0xffffffff
call fcn.00401730
mov dword [0x4c801c], 1
call edi
mov dword [0x4cce94], eax
test bh, bh
je 0x41266f
lea ecx, [esp + 0x18]
call fcn.004126b0
jmp 0x41267a
mov ecx, dword [esp + 0x14]
mov dl, bl
call fcn.00410da0
cmp dword [0x4cd100], 2
mov eax, dword [0x4c8024]
jne 0x41268d
mov ecx, dword [eax + 0x60]
jmp 0x412690
mov ecx, dword [eax + 0x5c]
call fcn.004149b0
sub esi, 1
jne 0x412606
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x34
ret
Function at 0x414bb0
Capabilities:
Get graphical window text

Disassembly:
push edi
mov edi, dword [0x4ca76c]
test edi, edi
je 0x414c9c
mov ax, word [esp + 8]
push esi
imul esi, dword [0x4ca7d8], 0x70
mov byte [esi + edi + 5], cl
mov byte [esi + edi], dl
mov word [esi + edi + 2], ax
mov byte [esi + edi + 4], 0x69
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, dword [0x4ca76c]
mov ecx, edx
mov dword [0x4ca7d4], edx
sub ecx, dword [0x4cd020]
mov dword [0x4cd020], edx
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x4c2460]
imul ecx, dword [0x4ca7d8], 0x70
cvtpd2ps xmm0, xmm0
divss xmm0, dword [0x4c23ac]
movss dword [ecx + eax + 8], xmm0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4ca76c]
test esi, esi
je 0x414c72
cmp esi, dword [0x4ca7d0]
je 0x414c62
imul edx, dword [0x4ca7d8], 0x70
push 0x64
add edx, 0xc
add eax, edx
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [0x4ca7d8]
jmp 0x414c83
mov edx, dword [0x4ca7d8]
imul ecx, edx, 0x70
mov byte [ecx + eax + 0xc], 0
jmp 0x414c83
mov edx, dword [0x4ca7d8]
imul ecx, edx, 0x70
mov dword [ecx + eax + 0xc], 0x412f4e
inc edx
mov dword [0x4ca7d0], esi
xor eax, eax
cmp edx, dword [0x4c8028]
pop esi
cmovge edx, eax
mov dword [0x4ca7d8], edx
pop edi
ret

Function at 0x414ca0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push ebp
push esi
mov bl, cl
push edi
movzx ebp, bl
mov edi, edx
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
movzx esi, ax
xor esi, 0xffffffff
and esi, 1
inc esi
cmp edi, 1
je 0x414cd0
cmp edi, 2
jne 0x414da4
cmp esi, edi
je 0x414da4
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x414d00
push 0xffc3d44d
push 0
push 0
push 0
mov dl, bl
mov ecx, 1
call fcn.00412a10
add esp, 0x10
push 0xffc3d44d
push 0
push 0
push 0
mov dl, bl
mov ecx, 2
call fcn.00412a10
add esp, 0x10
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4cc810]
sete bh
jne 0x414d55
mov edx, 1
mov dword [0x4c801c], 0
or ecx, 0xffffffff
call fcn.00401730
mov dword [0x4c801c], 1
cmp bl, 0x14
jne 0x414da4
cmp edi, 2
jne 0x414da4
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x414da4
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x10
mov ecx, edi
call fcn.00412a10
add esp, 0x10
test bh, bh
je 0x414da4
lea edx, [edi - 1]
mov dword [0x4c801c], 0
or ecx, 0xffffffff
call fcn.00401730
mov dword [0x4c801c], 1
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4154e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
cmp dword [0x4ca774], 0
je 0x4154f5
test cl, cl
jne 0x4154f5
mov al, byte [0x4cb0be]
pop ecx
ret
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0xa0
call esi
mov bx, ax
shr bx, 0xb
push 0xa1
and bl, 0x10
call esi
mov cl, bl
mov edi, 0x8000
or cl, 0x20
and ax, di
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
push 0xa2
mov dword [esp + 0x10], edx
call esi
mov edx, dword [esp + 0xc]
mov cl, dl
or cl, 1
and ax, di
movzx ebx, cl
movzx ecx, dl
push 0xa3
cmove ebx, ecx
call esi
mov cl, bl
or cl, 2
and ax, di
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
push 0xa4
mov dword [esp + 0x10], edx
call esi
mov edx, dword [esp + 0xc]
mov cl, dl
or cl, 4
and ax, di
movzx ebx, cl
movzx ecx, dl
push 0xa5
cmove ebx, ecx
call esi
mov cl, bl
or cl, 8
and ax, di
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
push 0x5b
mov dword [esp + 0x10], edx
call esi
mov edx, dword [esp + 0xc]
mov cl, dl
or cl, 0x40
and ax, di
movzx ebx, cl
movzx ecx, dl
push 0x5c
cmove ebx, ecx
call esi
mov cl, bl
or cl, 0x80
and ax, di
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
cmp dword [0x4ca774], 0
mov dword [esp + 0xc], edx
je 0x415632
mov cl, byte [0x4cb0be]
mov bl, dl
not bl
and bl, cl
je 0x415632
mov dl, byte [0x4cb0bc]
mov al, bl
not al
and byte [0x4cb0bd], al
and cl, al
and dl, al
mov byte [0x4cb0be], cl
mov ecx, 0x4cb0c0
mov byte [0x4cb0bc], dl
call fcn.00415640
mov ecx, dword [0x4cb1e8]
mov edx, dword [esp + 0xc]
test ecx, ecx
je 0x415632
test byte [ecx + 8], bl
mov eax, 0
cmovne ecx, eax
mov dword [0x4cb1e8], ecx
pop edi
pop esi
mov al, dl
pop ebx
pop ecx
ret
Function at 0x415aa0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x114
push ebx
push esi
mov al, cl
mov ebx, edx
push edi
mov byte [esp + 0xd], al
xor edi, edi
cmp byte [edi*8 + 0x4c80a4], al
je 0x415c16
inc edi
cmp edi, 0x6d
jl 0x415ab3
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
mov al, byte [esp + 0xd]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x415baf
push ebp
push 0x100
lea eax, [esp + 0x28]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ebp, dword [sym.imp.USER32.dll_ToAsciiEx]
lea eax, [esp + 0x20]
add esp, 0xc
mov byte [esp + 0x12], 0
push esi
push 0
push eax
lea eax, [esp + 0x30]
push eax
push 0
push 0x6e
call ebp
movzx ecx, byte [esp + 0x14]
cmp eax, 2
movzx edx, byte [esp + 0x12]
lea eax, [esp + 0x14]
movzx edi, byte [esp + 0x11]
cmove edx, ecx
push esi
push 0
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x28], edx
push eax
push 0
push edi
call ebp
mov dword [esp + 0x20], eax
test eax, eax
jns 0x415b59
push esi
push 0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push 0x6e
call ebp
mov eax, dword [esp + 0x1c]
test al, al
je 0x415b9e
push 1
push esi
lea edx, [esp + 0x1a]
mov cl, al
call fcn.00415e40
add esp, 8
mov byte [esp + 0x13], al
test al, al
je 0x415b9e
mov dl, byte [esp + 0x12]
lea ecx, [esp + 0x24]
call fcn.00415640
push esi
push 0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x30]
push eax
movzx eax, byte [esp + 0x23]
push 0
push eax
call ebp
movzx eax, byte [esp + 0x14]
xor ecx, ecx
cmp dword [esp + 0x20], ecx
pop ebp
cmovne ecx, eax
jmp 0x415bbe
push esi
movzx edi, al
push 2
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
mov cl, al
mov byte [ebx], cl
test cl, cl
je 0x415bd4
pop edi
pop esi
mov byte [ebx + 1], 0
mov eax, ebx
pop ebx
add esp, 0x114
ret
cmp byte [esp + 0x128], 0
je 0x415c07
cmp byte [esp + 0xd], 0
je 0x415c07
push edi
push str.vk_02X
push dword [esp + 0x12c]
push ebx
call fcn.0049e760
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x114
ret
pop edi
pop esi
mov byte [ebx], 0
mov eax, ebx
pop ebx
add esp, 0x114
ret
mov esi, dword [esp + 0x124]
dec esi
push esi
push dword [edi*8 + 0x4c80a0]
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
mov byte [esi + ebx], 0
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x114
ret
Function at 0x415d30
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov bl, byte [edi]
test bl, bl
je 0x415e36
cmp byte [edi + 1], 0
jne 0x415d5b
push 1
push dword [esp + 0x20]
mov cl, bl
call fcn.00415e40
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
movzx eax, bl
test eax, 0xffffff80
je 0x415d6f
xor eax, eax
jmp 0x415d77
push 2
push eax
call esi
add esp, 8
mov cl, bl
and cl, 0xdf
test eax, eax
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
cmp dl, 0x56
jne 0x415de3
mov bl, byte [edi + 1]
movzx eax, bl
test eax, 0xffffff80
je 0x415d9d
xor eax, eax
jmp 0x415da5
push 2
push eax
call esi
add esp, 8
mov cl, bl
and cl, 0xdf
test eax, eax
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
cmp dl, 0x4b
jne 0x415de3
push 0x10
lea eax, [esp + 0x10]
push eax
lea eax, [edi + 2]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov ecx, dword [esp + 0x18]
add esp, 0xc
xor ebx, ebx
movzx edx, al
cmp byte [ecx], bl
pop edi
cmove ebx, edx
pop esi
mov al, bl
pop ebx
pop ecx
ret
mov ebx, dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
xor esi, esi
nop dword [eax + eax]
push edi
push dword [esi*8 + 0x4c80a0]
call ebx
add esp, 8
test eax, eax
je 0x415e2a
inc esi
cmp esi, 0x6d
jl 0x415df0
cmp byte [esp + 0x14], 0
jne 0x415e36
xor edx, edx
mov ecx, edi
call fcn.00415c40
movzx ecx, ax
test cx, cx
je 0x415e36
pop edi
pop esi
pop ebx
add esp, 4
jmp fcn.00416710
mov al, byte [esi*8 + 0x4c80a4]
pop edi
pop esi
pop ebx
pop ecx
ret
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret

Function at 0x415e40
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
mov ebx, ecx
push edi
mov edi, edx
cmp bl, 0xa
jne 0x415e52
pop edi
mov al, 0xd
pop ebx
pop ecx
ret
push ebp
push esi
push dword [esp + 0x18]
push ebx
call dword [sym.imp.USER32.dll_VkKeyScanExA]
movzx eax, ax
mov edx, eax
mov dword [esp + 0x10], eax
shr edx, 8
cmp dl, 0xff
jne 0x415ec7
cmp al, 0xff
jne 0x415ec7
cmp byte [esp + 0x1c], 0
je 0x415ed0
movzx ebp, bl
test ebp, 0xffffff80
jne 0x415ed0
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
push 0x103
push ebp
call esi
add esp, 8
test eax, eax
je 0x415ed0
push 2
push ebp
call esi
push 1
push ebp
mov esi, eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
add esp, 0x10
mov cl, bl
test eax, eax
movzx eax, bl
setne dl
and cl, 0xdf
test esi, esi
movzx ecx, cl
cmove ecx, eax
mov bl, cl
jmp 0x415ecb
mov ebx, dword [esp + 0x10]
test dl, 0x38
je 0x415ed8
pop esi
pop ebp
pop edi
xor al, al
pop ebx
pop ecx
ret
test edi, edi
je 0x415f18
mov al, dl
and al, 6
cmp al, 6
jne 0x415ee9
or byte [edi], 8
jmp 0x415f07
test dl, 2
je 0x415ef8
mov al, byte [edi]
test al, 3
jne 0x415ef8
or al, 1
mov byte [edi], al
test dl, 4
je 0x415f07
mov al, byte [edi]
test al, 0xc
jne 0x415f07
or al, 4
mov byte [edi], al
test dl, 1
je 0x415f18
mov cl, byte [edi]
test cl, 0x30
jne 0x415f18
or cl, 0x10
mov byte [edi], cl
pop esi
pop ebp
pop edi
mov al, bl
pop ebx
pop ecx
ret
Function at 0x4162f0
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
movzx esi, cl
mov bl, dl
lea eax, [esi - 0x13]
cmp eax, 0x92
ja case.0x41630c.20
movzx eax, byte [eax + 0x4165ac]
jmp dword [eax*4 + 0x416540]
mov ecx, 0x2a
xor eax, eax
movzx ecx, cx
test bl, bl
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x136
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x1d
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x11d
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x38
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x138
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x15b
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x15c
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x45
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x52
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x4f
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x50
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x51
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x4b
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x4c
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x4d
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x47
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x48
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x49
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x53
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x145
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x135
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x37
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x4a
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x4e
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x137
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx ecx, ax
test cx, cx
jne 0x4164fd
pop esi
xor eax, eax
pop ebx
ret
add esi, 0xfffffffd
cmp esi, 0xb4
ja case.0x416513.4
movzx eax, byte [esi + 0x41664c]
jmp dword [eax*4 + 0x416640]
or ecx, 0x100
xor eax, eax
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
mov eax, ecx
or ecx, 0x100
test bl, bl
pop esi
cmovne eax, ecx
pop ebx
ret
Function at 0x416710
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, ecx
movzx edx, bx
mov eax, edx
cmp edx, 0x11c
ja 0x416788
je 0x416784
sub eax, 0x1d
cmp eax, 0x36
ja case.0x416799.286
movzx eax, byte [eax + 0x41683c]
jmp dword [eax*4 + 0x4167f0]
mov al, 0xa0
pop ebx
ret
mov al, 0xa2
pop ebx
ret
mov al, 0xa4
pop ebx
ret
mov al, 0x6a
pop ebx
ret
mov al, 0x6d
pop ebx
ret
mov al, 0x6b
pop ebx
ret
mov al, 0x2e
pop ebx
ret
mov al, 0xc
pop ebx
ret
mov al, 0x2d
pop ebx
ret
mov al, 0x26
pop ebx
ret
mov al, 0x28
pop ebx
ret
mov al, 0x25
pop ebx
ret
mov al, 0x27
pop ebx
ret
mov al, 0x24
pop ebx
ret
mov al, 0x23
pop ebx
ret
mov al, 0x21
pop ebx
ret
mov al, 0x22
pop ebx
ret
mov al, 0x13
pop ebx
ret
mov al, 0xd
pop ebx
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x416799.286
movzx eax, byte [eax + 0x41689c]
jmp dword [eax*4 + 0x416874]
mov al, 0xa1
pop ebx
ret
mov al, 0xa3
pop ebx
ret
mov al, 0xa5
pop ebx
ret
mov al, 0x5b
pop ebx
ret
mov al, 0x5c
pop ebx
ret
mov al, 0x90
pop ebx
ret
mov al, 0x6f
pop ebx
ret
mov al, 0x5d
pop ebx
ret
mov al, 0x2c
pop ebx
ret
test ebx, 0x100
je 0x4167e1
movzx eax, dl
push 1
or eax, 0xe000
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test eax, eax
jne 0x4167ed
push 1
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
pop ebx
ret
Function at 0x4184e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 8]
not ecx
cmp esi, 8
jb 0x41859d
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b9988]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b9988]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b9988]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b9988]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b9988]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b9988]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b9988]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b9988]
sub edi, 1
jne 0x4184f6
pop edi
test esi, esi
je 0x4185bb
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b9988]
sub esi, 1
jne 0x4185a1
not ecx
mov eax, ecx
pop esi
ret

Function at 0x4189d0
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
test byte [esi], 1
jne 0x418a03
push 0
lea eax, [esp + 8]
push eax
push dword [esp + 0x14]
push edx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4189fc
mov dword [esi + 8], 7
pop esi
pop ecx
ret
mov eax, dword [esp + 4]
pop esi
pop ecx
ret
mov ecx, dword [esi + 0x10]
xor eax, eax
push ebx
mov ebx, dword [esi + 0x18]
push ebp
push edi
mov edi, dword [esp + 0x18]
mov ebp, edi
add ebp, ebx
adc eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x14]
jb 0x418a28
ja 0x418a24
cmp ebp, ecx
jbe 0x418a28
mov edi, ecx
sub edi, ebx
mov ecx, dword [esi + 4]
push edi
add ecx, ebx
push ecx
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, edi
add dword [esi + 0x18], edi
adc dword [esi + 0x1c], 0
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
Function at 0x419da0
Capabilities:
Create directory

Disassembly:
sub esp, 0x10
mov al, byte [ecx]
mov dword [esp + 4], 0xc
mov dword [esp + 8], 0
mov dword [esp + 0xc], 1
mov dword [esp], ecx
push ebx
mov ebx, edx
push ebp
push esi
push edi
test al, al
je 0x419dd6
cmp byte [ecx + 1], 0x3a
jne 0x419dd6
mov al, byte [ecx + 2]
add ecx, 2
mov dl, al
cmp al, 0x5c
jne 0x419ddf
mov dl, byte [ecx + 1]
lea esi, [ecx + 1]
cmovne esi, ecx
test dl, dl
je 0x419e38
mov al, byte [esi]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test al, al
je 0x419e0c
nop dword [eax + eax]
cmp al, 0x5c
je 0x419e45
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x419e00
xor esi, esi
test ebx, ebx
je 0x419e38
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call ebp
test eax, eax
jne 0x419e2a
call edi
cmp eax, 0xb7
jne 0x419e4a
test esi, esi
je 0x419e38
mov byte [esi], 0x5c
inc esi
mov al, byte [esi]
test al, al
jne 0x419e00
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
mov byte [esi], 0
jmp 0x419e12
test esi, esi
je 0x419e51
mov byte [esi], 0x5c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x419e60
Capabilities:
Create directory

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
movzx esi, word [ecx]
mov ebx, edx
mov dword [esp + 0x10], 0xc
mov eax, esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 1
mov dword [esp + 0xc], ecx
push edi
test si, si
je 0x419e9d
cmp word [ecx + 2], 0x3a
jne 0x419e9d
movzx eax, word [ecx + 4]
add ecx, 4
movzx edi, ax
movzx edx, ax
cmp ax, 0x5c
jne 0x419ead
movzx edx, word [ecx + 2]
cmp edi, 0x5c
lea esi, [ecx + 2]
cmovne esi, ecx
test dx, dx
je 0x419f21
movzx ecx, word [esi]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
nop word [eax + eax]
movzx eax, cx
test ax, ax
je 0x419eea
cmp ax, 0x5c
je 0x419f2e
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x419ed8
xor esi, esi
test ebx, ebx
je 0x419f21
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call ebp
test eax, eax
jne 0x419f08
call edi
cmp eax, 0xb7
jne 0x419f35
test esi, esi
je 0x419f21
mov eax, 0x5c
mov word [esi], ax
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x419ed0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
xor eax, eax
mov word [esi], ax
jmp 0x419ef0
test esi, esi
je 0x419f41
mov eax, 0x5c
mov word [esi], ax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret