joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442ba0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.00442248
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00406308
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x442bff
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x55c7fc]
mov dl, 1
mov eax, dword [0x442098]
call fcn.0041492c
call fcn.00404c54
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x442c3c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x442d97
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
call fcn.00442248
mov dword [ebp - 0xc], eax
mov eax, esi
xor edx, edx
call fcn.0040627c
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x442c91
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
jmp 0x442c94
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
dec eax
sub al, 2
jae 0x442ca3
add dword [ebp - 0x10], 2
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x442c08]
call fcn.00407d10
add esp, 4
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.0040367c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, edi
call fcn.00406308
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov ebx, eax
test ebx, ebx
jne 0x442cf9
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406428
mov edx, dword [esi]
mov eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x442d0c
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x802
jle 0x442d61
mov eax, edx
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x442d24
sub esi, 4
mov esi, dword [esi]
push 0x442db4
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040d350
push dword [ebp - 0x1c]
push 0x442df4
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0040d350
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00406834
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dl, 1
call fcn.00442180
mov eax, dword [ebp - 0xc]
call fcn.00442278
mov edx, dword [ebp + 0xc]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442d9e
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00406274
lea eax, [ebp - 4]
mov edx, dword [0x442c08]
call fcn.00407d1c
ret
Function at 0x44301c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
xor edx, edx
call fcn.0040627c
push 0
push edi
lea eax, [ebp - 0x20a]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040647c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x443064
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040647c
add esp, 0x200
pop ebx
ret

Function at 0x443094
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push esp
push 0xff
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040647c
add esp, 0x200
pop ebx
ret

Function at 0x4430c0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040647c
add esp, 0x200
pop ebx
ret

Function at 0x4430f0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
mov ebx, eax
mov eax, ebx
xor edx, edx
call fcn.0040627c
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x44312d
mov eax, ebx
lea edx, [ebp - 0x20c]
call fcn.00406428
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x443134
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4431b0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
jbe 0x443197
push ebx
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040647c
mov eax, dword [ebp - 0x20c]
mov ecx, 2
mov edx, 1
call fcn.00406a28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4431b7
lea eax, [ebp - 0x20c]
call fcn.0040626c
ret
Function at 0x443b58
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x443cbb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x443bd6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 8
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.0040647c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x443c01
xor eax, eax
push ebp
push 0x443c43
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1a
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 4
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.0040647c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x443c6e
lea edx, [ebp - 0x224]
xor eax, eax
call fcn.004033e8
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.0040dfe8
mov edx, dword [ebp - 0x220]
mov eax, dword [ebp - 4]
add eax, 0xc
call fcn.0040627c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443cc2
lea eax, [ebp - 0x224]
mov edx, 4
call fcn.00406274
ret
Function at 0x443e5c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x443ef6
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x443e7b
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x443f0c
dec edx
je 0x443f41
jmp 0x443f92
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x443f92
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x444074
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x444093
add edx, 3
sar edx, 2
test edx, edx
jle 0x4441a1
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x4440c8
je 0x44410b
sub ecx, 0x2b
je 0x444101
sub ecx, 4
je 0x444106
dec ecx
sub ecx, 0xa
jb 0x4440f3
jmp 0x44410e
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4440da
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4440e5
jmp 0x44410e
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x44410e
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x44410e
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x44410e
mov byte [eax], 0x3e
jmp 0x44410e
mov byte [eax], 0x3f
jmp 0x44410e
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4440ab
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x44415f
cmp byte [esp + 7], 0xff
jne 0x44415f
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x444196
cmp dl, 0xff
je 0x444196
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x4440a2
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x444dd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x444df1
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x444dde
pop edi
pop esi
pop ebx
ret

Function at 0x445e18
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jb 0x445e6c
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x5504bc]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x5508bc]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x550cbc]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x5510bc]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x445e26
pop edi
pop esi
pop ebx
ret
Function at 0x44ccc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x44ccef
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x44cd6e
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0044b590
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x44cd3c
mov cx, word [esp]
sub cx, si
jmp 0x44cd3e
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x44cd25
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x44cd64
mov cx, word [esp]
sub cx, si
jmp 0x44cd66
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x44cd4d
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x44cdcb
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.0044c994
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x44cdb6
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x44cdcb
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x44ccca
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45c5d8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00406264
xor eax, eax
push ebp
push 0x45c76d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x45c73b
xor edx, edx
push ebp
push 0x45c734
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004062d0
mov eax, dword [ebp - 8]
test eax, eax
je 0x45c647
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x45c647
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.004056e8
test eax, eax
je 0x45c650
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x45c709
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x45c6f8
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004062d0
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45c6b2
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x45c6b2
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004056e8
test eax, eax
je 0x45c6bb
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.00406308
lea ecx, [esi + 2]
mov edx, ebx
call fcn.0040322c
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 0x10]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c6ff
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x55c2f8]
mov dl, 1
mov eax, dword [0x40afe8]
call fcn.004148f0
call fcn.00404c54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c774
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406274
ret

Function at 0x45ee04
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.0040627c
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x45ee4b
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040647c
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x464264
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46439d
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x434944]
call fcn.00434a80
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x464373
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00434b20
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040647c
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x4643b8
call fcn.00406750
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00434cac
test al, al
je 0x46435d
lea ecx, [ebp - 4]
mov edx, 0x46442c
mov eax, dword [ebp - 0xc]
call fcn.00434ef8
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0041733c
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x464356
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x464444
mov eax, dword [ebp - 8]
push eax
call fcn.00409780
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x5554b4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46435d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46437a
mov eax, dword [ebp - 0xc]
call fcn.00403dbc
ret

Function at 0x4644a8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x4644ef
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4644d2
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4644e3
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x4644ef
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x469e88
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x562354], 0
je 0x469fc9
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x55c934]
mov edx, dword [edx]
xor al, byte [edx + 0xb8]
je 0x469fc9
mov eax, dword [0x562358]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x562354]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x469f98
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x562354]
call fcn.00425840
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x469f90
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1e2], 0
je 0x469f90
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x469f90
mov eax, dword [ebp - 0x14]
call fcn.00475198
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x469f90
push ebp
call fcn.00469e44
pop ecx
test al, al
jne 0x469f90
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00404004
test al, al
je 0x469f90
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00404004
cmp byte [ebp - 1], 0
je 0x469f90
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.004093d8
test al, al
je 0x469f90
mov edx, dword [ebp - 0x14]
mov eax, dword [0x562358]
call fcn.004695bc
inc edi
dec ebx
jne 0x469eed
mov eax, dword [0x562358]
cmp dword [eax + 8], 0
jle 0x469fb0
mov eax, dword [0x562358]
call fcn.00469674
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x469fc9
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00469ca8
pop ecx
test al, al
jne 0x469fc9
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471e84
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.004093c0
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0046c304
test ebx, ebx
jne 0x471ed7
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00471d18
mov ebx, eax
test ebx, ebx
je 0x471fc2
cmp esi, ebx
je 0x471f00
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x471f15
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x471f4d
add eax, 0xffffff5f
sub eax, 2
jb 0x471f65
dec eax
sub eax, 2
jb 0x471f79
dec eax
sub eax, 2
jb 0x471f6f
jmp 0x471f83
add eax, 0xfffffdff
sub eax, 2
jb 0x471f65
dec eax
sub eax, 2
jb 0x471f79
dec eax
sub eax, 2
jb 0x471f6f
jmp 0x471f83
mov byte [esp + 0x120], 0
jmp 0x471f8b
mov byte [esp + 0x120], 2
jmp 0x471f8b
mov byte [esp + 0x120], 1
jmp 0x471f8b
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.00482668
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0046dad8
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x471fc4
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x48216c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x48218d
test edi, 0x40000
je 0x4821a7
test bl, bl
jne 0x482228
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x482228
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x4821da
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x4821ef
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x4821fe
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x48220f
cmp byte [esp + 2], 0
je 0x482228
cmp byte [esp + 2], 0
je 0x482220
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x482228
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret