joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416368
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4163a1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406be0
jmp 0x4163aa
mov eax, ebx
mov edx, esi
call fcn.00406aa4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4163b4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4163d6
movzx eax, word [esp]
jmp 0x4163d8
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x416b68
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x416c8d
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00416978
mov esi, eax
mov eax, dword [0x5662b8]
cmp byte [eax], 0
je 0x416c35
mov eax, dword [0x565dd8]
call fcn.00404720
call fcn.004043ac
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x416b40]
call fcn.004082d8
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x416ca8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x416c71
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x565d2c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x569c40]
call fcn.004084e0
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416c94
lea eax, [ebp - 4]
mov edx, dword [0x416b40]
call fcn.004083f8
ret
Function at 0x417abc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x417b92
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406af8
lea eax, [ebp - 4]
call fcn.004074b8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406b30
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x417b7c
mov eax, ebx
call fcn.00404244
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x417b75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406b30
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x417b5f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x417ba4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x417b5f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417b7c
mov eax, dword [ebp - 0x10]
call fcn.00404260
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417b99
lea eax, [ebp - 4]
call fcn.00406a94
ret

Function at 0x418da4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004064b0
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x418d4e
mov eax, edi
add eax, eax
call fcn.00404244
mov esi, eax
jmp 0x418d50
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x418d89
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x418d73
mov eax, esp
cmp esi, eax
je 0x418d96
mov eax, esi
call fcn.00404260
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x418dd0
cmp bl, 0
je 0x418dcc
cmp bl, 0x41
jl 0x418dc7
cmp bl, 0x5a
jg 0x418dc7
or bl, 0x20
xor al, bl
inc esi
jmp 0x418dab
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x418d10
Function at 0x43acf8
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x43ad96
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x43ad5a
cmp byte [ebx + 0x10], 0
jne 0x43ad5a
cmp byte [ebx + 0x3c], 0
jne 0x43ad5a
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x43ad7b
lea edx, [ebp - 4]
mov eax, dword [0x566220]
call fcn.00409cbc
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x42c9c0]
call fcn.00416ce0
call fcn.0040591c
jmp 0x43ad7b
lea edx, [ebp - 8]
mov eax, dword [0x566220]
call fcn.00409cbc
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x42c9c0]
call fcn.00416ce0
call fcn.0040591c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ad9d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406a9c
ret

Function at 0x43b084
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x43b0d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0043ac7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43b0eb
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x43b0f4
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0043ac7c
dec esi
jne 0x43b116
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x43c6d4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x56bf9c
cmp dword [edi], 0
jne 0x43c750
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x56bf98]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x55efc8
mov ecx, 2
call fcn.004043fc
mov edx, 0x43c6ac
lea eax, [esi + 5]
call fcn.0043c6cc
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0043c6cc
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x43c725
mov dword [0x56bf98], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4430e8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4431a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0044307c
test al, al
je 0x443182
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406be0
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x443182
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406b30
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.00406b30
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00406c60
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x44313b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4431a7
lea eax, [ebp - 0x2c]
call fcn.00406a94
lea eax, [ebp - 4]
call fcn.00406a94
ret

Function at 0x443458
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00406b30
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.00442df4
test al, al
jne 0x4434b9
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x56655c]
mov dl, 1
mov eax, dword [0x441b0c]
call fcn.00416dd8
call fcn.0040591c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00442d5c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x449178
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x44917e
ret
Function at 0x454318
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4544d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
jne 0x4544b1
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x4544b1
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x28]
add ebx, ebx
add ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
imul ebx
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4542e4]
call fcn.004082d8
add esp, 4
lea eax, [ebp - 4]
call fcn.00409750
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [0x565dec]
push eax
call fcn.0044165c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00408110
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x2c
call fcn.00404810
mov dword [ebp - 0x38], 0x2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
neg eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], 1
mov word [ebp - 0x2a], 0x20
mov dl, 1
mov eax, dword [0x447ab8]
call fcn.00450e40
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], ebx
xor ecx, ecx
push ebp
push 0x45448f
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, ebx
mov dl, 7
call fcn.004529c8
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
push 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
call fcn.00451760
call fcn.0044c0dc
push eax
call sub.gdi32.dll_SetDIBits
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov dl, 1
call fcn.00451ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4544b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4544dc
lea eax, [ebp - 8]
mov edx, dword [0x4542e4]
call fcn.004083f8
lea eax, [ebp - 4]
call fcn.00409750
ret
Function at 0x456610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x45663f
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4566be
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00454ee0
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x45668c
mov cx, word [esp]
sub cx, si
jmp 0x45668e
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x456675
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4566b4
mov cx, word [esp]
sub cx, si
jmp 0x4566b6
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x45669d
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x45671b
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004562e4
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x456706
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x45671b
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x45661a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47009c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00406a8c
xor eax, eax
push ebp
push 0x470231
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4701ff
xor edx, edx
push ebp
push 0x4701f8
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406af8
mov eax, dword [ebp - 8]
test eax, eax
je 0x47010b
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x47010b
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.004062dc
test eax, eax
je 0x470114
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4701cd
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x4701bc
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00406af8
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x470176
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x470176
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004062dc
test eax, eax
je 0x47017f
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.00406b30
lea ecx, [esi + 2]
mov edx, ebx
call fcn.004043fc
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 0x10]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4701c3
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x565bf0]
mov dl, 1
mov eax, dword [0x40d684]
call fcn.00416d9c
call fcn.0040591c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470238
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406a9c
ret

Function at 0x47425c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406aa4
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4742a3
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00406cb4
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x479728
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x479861
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x441d00]
call fcn.00442d84
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x479837
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00442e30
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.00406cb4
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x47987c
call fcn.00406f88
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00442e94
test al, al
je 0x479821
lea ecx, [ebp - 4]
mov edx, 0x4798f0
mov eax, dword [ebp - 0xc]
call fcn.004433d8
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00419578
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x47981a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x479908
mov eax, dword [ebp - 8]
push eax
call fcn.0040b24c
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x563428]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479821
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47983e
mov eax, dword [ebp - 0xc]
call fcn.00404e4c
ret

Function at 0x47996c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x4799b3
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x479996
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4799a7
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x4799b3
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4875ac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x56c268], 0
je 0x4876ed
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x5661d8]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x4876ed
mov eax, dword [0x56c26c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x56c268]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4876bc
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x56c268]
call fcn.004309d4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4876b4
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1ea], 0
je 0x4876b4
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x4876b4
mov eax, dword [ebp - 0x14]
call fcn.00492be4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4876b4
push ebp
call fcn.00487568
pop ecx
test al, al
jne 0x4876b4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.004050d0
test al, al
je 0x4876b4
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.004050d0
cmp byte [ebp - 1], 0
je 0x4876b4
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.0040a690
test al, al
je 0x4876b4
mov edx, dword [ebp - 0x14]
mov eax, dword [0x56c26c]
call fcn.00486cc4
inc edi
dec ebx
jne 0x487611
mov eax, dword [0x56c26c]
cmp dword [eax + 8], 0
jle 0x4876d4
mov eax, dword [0x56c26c]
call fcn.00486d7c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4876ed
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004873cc
pop ecx
test al, al
jne 0x4876ed
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f868
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0040a678
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00489b74
test ebx, ebx
jne 0x48f8bb
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0048f6e4
mov ebx, eax
test ebx, ebx
je 0x48f9b1
cmp esi, ebx
je 0x48f8e4
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x48f8f9
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x48f931
add eax, 0xffffff5f
sub eax, 2
jb 0x48f949
dec eax
sub eax, 2
jb 0x48f95d
dec eax
sub eax, 2
jb 0x48f953
jmp 0x48f967
add eax, 0xfffffdff
sub eax, 2
jb 0x48f949
dec eax
sub eax, 2
jb 0x48f95d
dec eax
sub eax, 2
jb 0x48f953
jmp 0x48f967
mov byte [esp + 0x120], 0
jmp 0x48f96f
mov byte [esp + 0x120], 2
jmp 0x48f96f
mov byte [esp + 0x120], 1
jmp 0x48f96f
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004ad5b8
mov esi, eax
call fcn.004863b0
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0048b3f4
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x48f9b3
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x4ad0c0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x4ad0e1
test edi, 0x40000
je 0x4ad0fb
test bl, bl
jne 0x4ad17c
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x4ad17c
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x4ad12e
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x4ad143
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x4ad152
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x4ad163
cmp byte [esp + 2], 0
je 0x4ad17c
cmp byte [esp + 2], 0
je 0x4ad174
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x4ad17c
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret