joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003ea30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1008c180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x1003eb18
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10040b90
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
je 0x1003eb18
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003ea87
sub ecx, esi
mov eax, 0x103
sar ecx, 1
sub eax, ecx
cmp edx, eax
jae 0x1003eb18
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x1003eab0
mov eax, dword [0x10070bb8]
mov esi, ebx
mov dword [edi], eax
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x1003eac5
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1003eae0
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002735f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1002735f
mov esp, ebp
pop ebp
ret
Function at 0x1003eb30
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x1008c180]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.10040b90
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.1003dff0
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1003eb9a
mov al, byte [edi + ecx]
test al, al
je 0x1003eb9a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1003eb81
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x1003ebbb
inc eax
sub ecx, 1
jne 0x1003ebb0
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x1003ec10
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x1003ec05
lea edi, [ebp - 0x84]
mov eax, 0x7fffffff
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x1003ec04
mov bl, byte [edi + ecx]
test bl, bl
je 0x1003ec04
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x1003ebf0
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.10040b90
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x10070cc0
push str.SoftwareMaster2Liveup
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x1003ecca
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x1003ec94
test cl, cl
je 0x1003ec90
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x1003ec94
add eax, 2
add esi, 2
test cl, cl
jne 0x1003ec74
xor eax, eax
jmp 0x1003ec99
sbb eax, eax
or eax, 1
test eax, eax
je 0x1003ecca
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003eca6
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareMaster2Liveup
push 0x80000002
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003ecd3
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x10070cc0
push str.SoftwareMaster2Liveup
push 0x80000002
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002735f
mov esp, ebp
pop ebp
ret

Function at 0x1005dc61
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005d921
Function at 0x402f00
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404698
test esi, esi
jne 0x402f37
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404788
jmp 0x402f58
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402d9c
mov dword [esp], eax
test esi, esi
je 0x402f58
cmp dword [ebx], 0
je 0x402f58
dec esi
jmp 0x402f3f
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403698
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4be020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403730
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403710
xor eax, eax
push ebp
push 0x403709
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40374c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403710
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4be020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4be020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404514
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4c104c], 0
je 0x404575
cmp word [0x4c1220], 0xd7b2
jne 0x40453d
cmp dword [0x4c1228], 0
jbe 0x40453d
mov eax, 0x4c121c
call dword [0x4c1238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4be06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40459c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4be030], 0
jne 0x404591
push 0
push 0x4be064
push 0x4be06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406b3c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406ba2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404908
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040325c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406b8c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406ba9
lea eax, [ebp - 0x10]
call fcn.00404698
ret

Function at 0x40c924
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c95d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404788
jmp 0x40c966
mov eax, ebx
mov edx, esi
call fcn.004046ec
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c970
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c991
mov al, byte [esp]
jmp 0x40c993
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40d028
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ce90
mov eax, dword [0x4c0488]
cmp byte [eax], 0
je 0x40d0a4
mov eax, dword [0x4c019c]
call fcn.00403020
call fcn.00402cc8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409a58
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40d0ec
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40d0da
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4c0128]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4c1668]
call fcn.00405f8c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40d9c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40da96
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404730
lea eax, [ebp - 8]
call fcn.00404ba8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404b58
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40da80
mov eax, ebx
call fcn.00402b3c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40da79
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404b58
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40da63
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40daa8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40da63
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40da80
mov eax, dword [ebp - 0x10]
call fcn.00402b6c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40da9d
lea eax, [ebp - 8]
call fcn.00404698
ret

Function at 0x40e004
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40e068
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404908
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004094a8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e06f
lea eax, [ebp - 0xc]
call fcn.00404698
ret

Function at 0x40e860
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov eax, dword [0x4c01c8]
cmp dword [eax], 0
je 0x40e896
push 0xa
push 0x40e8ec
mov eax, dword [0x4c01c8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [0x4c01c8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_LoadResource
mov dword [esp], eax
jmp 0x40e8e2
xor eax, eax
mov dword [esp], eax
mov eax, dword [0x4c04f8]
mov eax, dword [eax]
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x40e8e2
mov ebx, dword [esp + 4]
push 0xa
push 0x40e8ec
mov esi, dword [ebx + 4]
push esi
call sub.kernel32.dll_FindResourceA
push eax
push esi
call sub.kernel32.dll_LoadResource
mov dword [esp], eax
cmp dword [esp], 0
jne 0x40e8e2
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jne 0x40e8ad
mov eax, dword [esp]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x40efcc
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.00404698
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.00404b58
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x40f011
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.00404788
jmp 0x40f02a
mov edx, ebx
dec edx
mov eax, esi
call fcn.00404ce4
push ebx
mov eax, dword [esi]
call fcn.00404b58
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x425004
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
lea ebx, [ebp - 0xc]
mov esi, 0x4c1888
cmp dword [esi], 0
jne 0x4250aa
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [0x4c1884]
mov dword [eax], edx
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, 0x4be650
mov ecx, 2
call fcn.00402d5c
mov edx, 0x424fdc
mov eax, dword [ebp - 8]
add eax, 5
call fcn.00424ffc
mov edx, dword [ebp - 8]
mov dword [edx + 6], eax
mov eax, dword [ebp - 8]
add eax, 0xa
mov dword [ebx], eax
mov eax, dword [ebx]
mov byte [eax], 0xe8
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, dword [ebx]
call fcn.00424ffc
mov edx, dword [ebx]
mov dword [edx + 1], eax
mov eax, dword [ebx]
mov edx, dword [esi]
mov dword [eax + 5], edx
mov eax, dword [ebx]
mov dword [esi], eax
add dword [ebx], 0xd
mov eax, dword [ebx]
sub eax, dword [ebp - 8]
cmp eax, 0xffc
jl 0x425071
mov eax, dword [ebp - 8]
mov dword [0x4c1884], eax
mov eax, dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [esi]
mov dword [ebx], eax
mov eax, dword [ebx]
mov eax, dword [eax + 5]
mov dword [esi], eax
mov eax, dword [ebx]
mov edx, dword [ebp + 8]
mov dword [eax + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 9], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4266f8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4266fe
ret

Function at 0x428bfc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x428c4d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x428c34
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x428c24
jmp 0x428c4d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x428c35
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438adc
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404b48
xor eax, eax
push ebp
push 0x438c0c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x438bdf
xor eax, eax
push ebp
push 0x438bd8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404958
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x438bad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x438b9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404958
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404b58
mov edx, dword [ebp - 0xc]
pop ecx
call fcn.00402d5c
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438ba3
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x4c0098]
mov dl, 1
mov eax, dword [0x407fac]
call fcn.0040d1dc
call fcn.00404090
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438c13
lea eax, [ebp - 4]
call fcn.00404698
ret
Function at 0x438c1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x438dcd
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404d48
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x438de4
call fcn.004049a4
mov eax, ebx
call fcn.00424580
mov edi, eax
dec edi
test edi, edi
jl 0x438cd4
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00424554
mov edx, dword [0x433a2c]
call fcn.004039c4
test al, al
je 0x438cd0
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00424554
lea edx, [ebp - 0x14]
call fcn.0043f9f8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404d48
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a18
inc esi
dec edi
jne 0x438c82
mov al, byte [0x438de8]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x438df4
mov eax, dword [ebp - 0xc]
call fcn.0040e5e0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404730
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0043f9f8
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x438de4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0043f9f8
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x438de4
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x438de4
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x438e00
call fcn.0040a178
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438dd4
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004046bc
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004046bc
lea eax, [ebp - 0x14]
call fcn.00404698
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004046bc
ret

Function at 0x43a3a8
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x43a2f4
call sub.user32.dll_EnumWindows
ret
Function at 0x43a4c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x43a545
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00439f28
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x43a4ed
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00439b28
cmp dword [ebp - 4], 0
je 0x43a52f
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404b58
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a54c
lea eax, [ebp - 4]
call fcn.00404698
ret

Function at 0x43d534
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4c1b20], 0
je 0x43d683
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4c03fc]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x43d683
mov eax, dword [0x4c1b24]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4c1b20]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x43d652
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4c1b20]
call fcn.0041dce8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x43d64a
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x43d64a
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x43d64a
mov eax, dword [ebp - 0x14]
call fcn.00446374
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43d64a
push ebp
call fcn.0043d4f0
pop ecx
test al, al
jne 0x43d64a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x43d606
mov eax, dword [ebp - 0x14]
call fcn.00444e6c
dec eax
jle 0x43d64a
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00403a34
cmp byte [ebp - 1], 0
je 0x43d64a
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x43d64a
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4c1b24]
call fcn.0043ccbc
inc edi
dec ebx
jne 0x43d599
mov eax, dword [0x4c1b24]
cmp dword [eax + 8], 0
jle 0x43d66a
mov eax, dword [0x4c1b24]
call fcn.0043cd4c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43d683
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0043d358
pop ecx
test al, al
jne 0x43d683
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x440c84
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x440cd0
mov eax, esi
call fcn.00456770
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x440cd0
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x440cd0
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x440e0f
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x440d10
cmp eax, 0x108
ja 0x440d10
mov eax, esi
call fcn.00456770
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x440e06
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x440e0f
jmp 0x440e06
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x440def
cmp eax, 0x20a
ja 0x440def
test byte [esi + 0x50], 0x80
jne 0x440d42
sub eax, 0x203
je 0x440d3f
sub eax, 3
je 0x440d3f
sub eax, 3
jne 0x440d42
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x440d56
dec eax
je 0x440d6b
dec eax
je 0x440d88
dec eax
je 0x440d6b
jmp 0x440d8f
mov ecx, ebx
mov eax, dword [0x4c03fc]
mov eax, dword [eax]
mov edx, esi
call fcn.00460074
jmp 0x440e06
cmp byte [esi + 0x5d], 1
jne 0x440d81
mov eax, esi
mov si, 0xffed
call fcn.00403a34
jmp 0x440e0f
or word [esi + 0x54], 1
jmp 0x440e06
and word [esi + 0x54], 0xfffe
jmp 0x440e06
mov eax, dword [0x4c1adc]
cmp byte [eax + 0x20], 0
je 0x440e06
mov eax, dword [0x4c1adc]
cmp dword [eax + 0x1c], 0
je 0x440e06
mov eax, dword [ebx]
mov edx, dword [0x4c1adc]
cmp eax, dword [edx + 0x1c]
jne 0x440e06
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.004566b4
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403a34
jmp 0x440e0f
cmp eax, 0xb00b
jne 0x440e06
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0043f598
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret