joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4705f0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
movzx eax, word [ebx + 0xf0]
push edi
mov edi, dword [esp + 0x1c]
push 0
push 0
push edi
push ebp
mov dword [esp + 0x24], eax
call sub.IMM32.dll_ImmGetCompositionStringW
mov esi, eax
test esi, esi
jle 0x470643
cmp dword [ebx + 0x7c], esi
jge 0x470643
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x470631
push eax
call fcn.00458250
add esp, 4
lea eax, [esi + 2]
push eax
call fcn.00458270
add esp, 4
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x7c], esi
push dword [ebx + 0x7c]
push dword [ebx + 0x78]
push edi
push ebp
call sub.IMM32.dll_ImmGetCompositionStringW
push 0
xor esi, esi
test eax, eax
push 0
push 0x80
cmovns esi, eax
push ebp
shr esi, 1
call sub.IMM32.dll_ImmGetCompositionStringW
movzx edx, ax
mov eax, dword [esp + 0x14]
mov dword [ebx + 0xa0], edx
cmp eax, 0x404
je 0x470683
cmp eax, 0x804
jne 0x4706c3
test edx, edx
je 0x4706c3
mov eax, dword [ebx + 0x7c]
shr eax, 1
cmp edx, eax
jae 0x4706c3
mov eax, dword [ebx + 0x78]
mov ecx, 0x3000
movzx eax, word [eax]
cmp ax, cx
je 0x4706a5
cmp eax, 0x20
jne 0x4706c3
inc edx
cmp edx, esi
jae 0x4706c2
nop word [eax + eax]
mov eax, dword [ebx + 0x78]
lea ecx, [eax + edx*2]
inc edx
mov ax, word [ecx]
mov word [ecx - 2], ax
cmp edx, esi
jl 0x4706b0
dec esi
mov eax, dword [ebx + 0x78]
xor ecx, ecx
mov word [eax + esi*2], cx
cmp dword [ebx + 0xa0], ecx
jne 0x470744
test esi, esi
jle 0x470744
xor esi, esi
push esi
push esi
push 0x10
push ebp
call sub.IMM32.dll_ImmGetCompositionStringW
mov edi, eax
test edi, edi
jle 0x47073e
lea ecx, [edi + 2]
push ecx
call fcn.00458270
add esp, 4
mov ebp, eax
push edi
push ebp
push 0x10
push dword [esp + 0x24]
call sub.IMM32.dll_ImmGetCompositionStringW
xor ecx, ecx
mov al, byte [ecx + ebp]
cmp al, 1
je 0x470717
cmp al, 3
je 0x470717
inc ecx
cmp ecx, edi
jl 0x470707
mov esi, ecx
cmp ecx, edi
jge 0x470732
nop dword [eax]
mov al, byte [esi + ebp]
cmp al, 1
je 0x47072b
cmp al, 3
jne 0x470735
inc esi
cmp esi, edi
jl 0x470720
cmp ecx, edi
cmove esi, edi
push ebp
call fcn.00458250
add esp, 4
mov dword [ebx + 0xa0], esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x471220
Capabilities:
Get keyboard layout

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0
movzx edi, word [esi + 0xf0]
and edi, 0x3ff
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, dword [esi + 0xf0]
cmp eax, ecx
je 0x471276
movzx edx, ax
mov ecx, edx
mov dword [esi + 0xf0], eax
and ecx, 0x3ff
cmp ecx, 0x12
je 0x47126c
mov ecx, 0x804
cmp dx, cx
je 0x47126c
mov ecx, 1
jmp 0x47126e
xor ecx, ecx
mov dword [esi + 0xc0], ecx
mov ecx, eax
cmp dword [esi + 0x110], 0
jne 0x471290
xor eax, eax
cmp ecx, 0xe0060404
setne al
mov dword [esi + 0xbc], eax
push esi
call fcn.00471500
movzx eax, word [esi + 0xf0]
add esp, 4
and eax, 0x3ff
cmp edi, eax
je 0x4712b2
push esi
call fcn.00470360
add esp, 4
pop edi
pop esi
ret
Function at 0x471810
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x804
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [esp + 0x808]
push ebx
push esi
push edi
mov esi, dword [eax + 0x448]
push 0x42
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x7c], 0x40
call fcn.00458270
mov dword [esi + 0x78], eax
xor ecx, ecx
push 0x10
mov word [eax], cx
xor eax, eax
push eax
mov word [esi + 0x80], ax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
mov dword [esi + 0xc4], eax
lea eax, [esi + 0xc8]
push eax
mov dword [esi + 0xc0], 1
call fcn.004588c0
push 0x10
lea eax, [esi + 0xd8]
push 0
push eax
call fcn.004588c0
lea eax, [esp + 0x28]
mov dword [esi + 0xe8], 0
push eax
mov dword [esi + 0xec], 0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], 0
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x10c], 0
mov dword [esi + 0x110], 0
mov dword [esi + 0x114], 0
mov dword [esi + 0x118], 0xffffffff
mov dword [esi + 0x11c], 0xffffffff
mov dword [esi + 0x120], 0xffffffff
mov dword [esi + 0x124], 0xffffffff
mov dword [esi + 0x128], 0
mov dword [esi + 0x12c], 0
call fcn.00440e30
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyW]
add esp, 0x20
xor esi, esi
mov edi, dword [esi*4 + 0x544218]
test edi, edi
je 0x4719ec
test dword [esp + edi*4 + 0xc], 0x40000000
jne 0x4719ec
push 1
push esi
call ebx
test eax, eax
je 0x4719ec
push 2
push eax
call ebx
and eax, 0x7fff
je 0x4719ec
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x4719e8
add eax, 0x20
mov dword [esp + edi*4 + 0xc], eax
inc esi
cmp esi, 0x80
jb 0x4719b3
push 0
push 0x200
lea eax, [esp + 0x14]
push eax
push 0
call fcn.00441c70
push str.Menu
push 0x65
call fcn.00441df0
push str.Left_Windows
push 0xe3
call fcn.00441df0
push str.Right_Windows
push 0xe7
call fcn.00441df0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
add esp, 0x28
push 0x14
call esi
and eax, 1
push eax
push 0x2000
call fcn.00441e10
add esp, 8
push 0x90
call esi
and eax, 1
push eax
push 0x1000
call fcn.00441e10
add esp, 8
push 0x91
call esi
and eax, 1
push eax
push 0x8000
call fcn.00441e10
mov ecx, dword [esp + 0x814]
add esp, 8
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401033
add esp, 0x804
ret
Function at 0x471b00
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x124
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x120], eax
push edi
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 0
push 0x20
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
test edi, edi
je 0x471b5f
push ebx
mov ebx, dword [sym.imp.USER32.dll_ToUnicode]
push esi
xor esi, esi
nop word [eax + eax]
push 0
push 0x10
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x38]
push eax
push edi
push 0x20
call ebx
test eax, eax
jg 0x471b5d
inc esi
cmp esi, 5
jl 0x471b40
pop esi
pop ebx
mov ecx, dword [esp + 0x124]
pop edi
xor ecx, esp
call fcn.00401033
add esp, 0x124
ret

Function at 0x471dc0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x804
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push esi
lea eax, [esp + 8]
push edi
push eax
call fcn.00440e30
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyW]
add esp, 4
xor esi, esi
nop dword [eax]
mov edi, dword [esi*4 + 0x544218]
test edi, edi
je 0x471e29
test dword [esp + edi*4 + 0xc], 0x40000000
jne 0x471e29
push 1
push esi
call ebx
test eax, eax
je 0x471e29
push 2
push eax
call ebx
and eax, 0x7fff
je 0x471e29
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x471e25
add eax, 0x20
mov dword [esp + edi*4 + 0xc], eax
inc esi
cmp esi, 0x80
jb 0x471df0
pop edi
pop esi
pop ebx
push dword [esp + 0x808]
lea eax, [esp + 4]
push 0x200
push eax
push 0
call fcn.00441c70
mov ecx, dword [esp + 0x810]
add esp, 0x10
xor ecx, esp
call fcn.00401033
add esp, 0x804
ret

Function at 0x473900
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0xc
cmp dword [0x57f4c4], 0
je 0x473946
push 0xc
push 1
lea eax, [esp + 8]
mov dword [esp + 8], 0x20001
push eax
mov dword [esp + 0x14], 0
mov dword [0x57f4c4], 0
mov dword [esp + 0x10], 1
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x473946
mov dword [0x57f4c4], eax
push esi
mov esi, dword [0x57f4c0]
test esi, esi
je 0x47396d
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyIcon]
push esi
call fcn.00458250
add esp, 4
mov dword [0x57f4c0], 0
pop esi
add esp, 0xc
ret
Function at 0x4739c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x88], eax
movd xmm0, dword [esp + 0x90]
lea eax, [esp]
cvtdq2ps xmm0, xmm0
push eax
push 0x20019
push 0
push str.Control_PanelMouse
push 0x80000001
divss xmm0, dword [0x544728]
mov dword [esp + 0x1c], 3
mov dword [esp + 0x18], 0x28
movss dword [esp + 0x20], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x473baf
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push str.SmoothMouseXCurve
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x473ba6
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x64]
push eax
call fcn.00473240
add esp, 8
test eax, eax
je 0x473ba6
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push str.SmoothMouseYCurve
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x473ba6
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x64]
push eax
call fcn.00473240
add esp, 8
test eax, eax
je 0x473ba6
movss xmm3, dword [esp + 0x10]
xorps xmm0, xmm0
comiss xmm3, xmm0
movss xmm2, dword [esp + 0xc]
jbe 0x473ac9
movss xmm1, dword [esp + 0x24]
divss xmm1, xmm3
mulss xmm1, xmm2
jmp 0x473acc
xorps xmm1, xmm1
movss dword [esp + 0x38], xmm3
movss xmm3, dword [0x544724]
divss xmm1, xmm3
movss xmm4, dword [esp + 0x14]
comiss xmm4, xmm0
movss dword [esp + 0x3c], xmm1
jbe 0x473aff
movss xmm1, dword [esp + 0x28]
divss xmm1, xmm4
mulss xmm1, xmm2
jmp 0x473b02
xorps xmm1, xmm1
divss xmm1, xmm3
movss dword [esp + 0x40], xmm4
movss xmm4, dword [esp + 0x18]
comiss xmm4, xmm0
movss dword [esp + 0x44], xmm1
jbe 0x473b2d
movss xmm1, dword [esp + 0x2c]
divss xmm1, xmm4
mulss xmm1, xmm2
jmp 0x473b30
xorps xmm1, xmm1
divss xmm1, xmm3
movss dword [esp + 0x48], xmm4
movss xmm4, dword [esp + 0x1c]
comiss xmm4, xmm0
movss dword [esp + 0x4c], xmm1
jbe 0x473b5b
movss xmm1, dword [esp + 0x30]
divss xmm1, xmm4
mulss xmm1, xmm2
jmp 0x473b5e
xorps xmm1, xmm1
divss xmm1, xmm3
movss dword [esp + 0x50], xmm4
movss dword [esp + 0x54], xmm1
movss xmm1, dword [esp + 0x20]
comiss xmm1, xmm0
jbe 0x473b87
movss xmm0, dword [esp + 0x34]
divss xmm0, xmm1
mulss xmm0, xmm2
divss xmm0, xmm3
lea eax, [esp + 0x38]
push eax
push 0xa
movss dword [esp + 0x60], xmm1
movss dword [esp + 0x64], xmm0
call fcn.0044add0
add esp, 8
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00401033
add esp, 0x8c
ret
Function at 0x47e430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
cmp dword [edi + 0x78], 0
jle 0x47e446
mov eax, 0x57bee0
pop edi
pop esi
pop ebx
ret
movups xmm0, xmmword [edi + 0x20]
sub esp, 0x10
mov eax, esp
push dword [edi + 4]
movups xmmword [eax], xmm0
call fcn.00440b30
add esp, 0x14
test eax, eax
jne 0x47e4d6
mov eax, 0x28de
cmp word [edi + 0x14], ax
je 0x47e492
movzx eax, word [edi + 0x40]
test ax, ax
je 0x47e47a
cmp eax, 1
jne 0x47e4d6
movzx eax, word [edi + 0x42]
test ax, ax
je 0x47e492
cmp eax, 4
je 0x47e492
cmp eax, 5
je 0x47e492
cmp eax, 8
jne 0x47e4d6
xor esi, esi
mov ebx, dword [esi + 0x569478]
cmp dword [ebx + 4], 0
je 0x47e4ce
push dword [edi + 0x3c]
movzx eax, word [edi + 0x18]
push dword [edi + 0x38]
push dword [edi + 0x34]
push dword [edi + 0x30]
push eax
movzx eax, word [edi + 0x16]
push eax
movzx eax, word [edi + 0x14]
push eax
push dword [edi + 0x4c]
mov eax, dword [ebx + 0x14]
push dword [edi + 4]
push edi
call eax
add esp, 0x28
test eax, eax
jne 0x47e4dc
add esi, 4
cmp esi, 0x44
jb 0x47e494
xor eax, eax
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x480eb0
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0xc
cmp dword [0x57f558], 0
je 0x480ef8
mov eax, dword [esp + 0x10]
push 0xc
mov dword [esp + 0xc], eax
lea eax, [esp + 4]
push 1
push eax
mov dword [esp + 0xc], 0x50001
mov dword [esp + 0x10], 0x2100
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x480ef8
push str.Couldnt_register_for_raw_input_events
call fcn.0041ad60
add esp, 4
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret

Function at 0x480ff0
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0xc
cmp dword [0x57f558], 0
je 0x481038
push 0xc
push 1
lea eax, [esp + 8]
mov dword [esp + 8], 0x50001
push eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x481038
push str.Couldnt_unregister_for_raw_input_events
call fcn.0041ad60
add esp, 4
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret
Function at 0x4a5ff0
Capabilities:
Get geographical location

Disassembly:
cmp dword [0x57f6fc], 0
jne 0x4a6020
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x57f6fc], eax
test eax, eax
je 0x4a6020
push str.GetUserPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x57f6f8], eax
jmp 0x4a6025
mov eax, dword [0x57f6f8]
test eax, eax
je fcn.004a6140
jmp fcn.004a6040

Function at 0x4a6140
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x24
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push edi
push 0x10
push eax
push 0x59
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x10
mov edi, eax
lea eax, [esp + 0xc]
push eax
push 0x5a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, eax
test edi, edi
jne 0x4a61a2
push 0x54a054
call fcn.0041ad60
add esp, 4
pop edi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00401033
add esp, 0x24
ret
test ecx, ecx
lea eax, [esp + 8]
mov edx, 0x51a9ae
cmove eax, edx
push eax
mov eax, 0x54a074
cmove eax, edx
push eax
lea eax, [esp + 0x20]
push eax
push str._s_s_s
push dword [esp + 0x44]
push ebx
call fcn.0041c250
mov ecx, dword [esp + 0x40]
add esp, 0x18
pop edi
pop ebx
xor ecx, esp
call fcn.00401033
add esp, 0x24
ret
Function at 0x50cde0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x50ce0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x50ce0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x511b1e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0050d280
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0040cf51
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x511b60
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x511cbc
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0050d0d0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x57db70]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.00411604
mov ecx, dword [esi*4 + 0x57db70]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x511cb5
cmp eax, dword [ecx + edi + 0x24]
jne 0x511cb5
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x511cb5
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00411604
add esp, 0x14
test edx, edx
jl 0x511cb5
jg 0x511c2b
test eax, eax
jb 0x511cb5
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x511cb5
jl 0x511c45
cmp dword [ebp - 0x1008], eax
ja 0x511cb5
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x511c63
test ebx, ebx
je 0x511c9c
cmp ecx, edi
jae 0x511c9c
mov al, byte [ecx]
cmp al, 0xd
jne 0x511c7d
lea eax, [edi - 1]
cmp ecx, eax
jae 0x511c89
cmp byte [ecx + 1], 0xa
jne 0x511c89
inc ecx
jmp 0x511c89
movzx eax, al
movsx eax, byte [eax + 0x5667d8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x511c63
cmp edx, ebx
jne 0x511c63
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x511cba
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00401033
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0xf7c7fc
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf7c806
pushal
call 0xf7c80c
pop ebp
sub ebp, 0x10
sub ebp, 0xb7c7fc
jmp 0xf7c822
mov eax, 0xb7c7fc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bb
mov edx, 0xea23ca4
xor byte [eax], dl
inc eax
dec ecx
jne 0xf7c839
jmp 0xf7c84c
das
imul ebp, dword [edi], 0xa4a4982d
movsb byte es:[edi], byte [esi]
and eax, 0xa4a45c65
movsb byte es:[edi], byte [esi]
cmpsd dword [esi], dword es:[edi]
imul ebx, dword [ebp*4 + 0x1ea4a4a4], 0xa4a4a48c
push ebx
inc esi
cmpsd dword [esi], dword es:[edi]
insb byte es:[edi], dx
das
and eax, 0xa4a4a4a8
cmpsd dword [esi], dword es:[edi]
popal
hlt
Function at 0x402f40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x777f76
mov eax, dword fs:[0]
push eax
sub esp, 0x1f0
mov eax, dword [0x84dfc0]
xor eax, esp
mov dword [esp + 0x1e8], eax
push ebx
push esi
push edi
mov eax, dword [0x84dfc0]
xor eax, esp
push eax
lea eax, [esp + 0x200]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 4]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [ebx + 4]
and eax, 0xff3fffff
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [ebx + 4]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov eax, dword [ebx + 4]
push 0x20
sub edx, ecx
push edx
mov edx, dword [esp + 0x20]
sub esi, edx
push esi
push ecx
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebx + 4]
lea esi, [ebx + 0x2c]
mov edi, esi
call fcn.00403ec0
lea eax, [ebx + 0x24]
push eax
call fcn.00406e90
xor edi, edi
mov dword [esp + 0xac], edi
mov dword [esp + 0xb0], edi
mov dword [esp + 0xb4], edi
mov byte [esp + 0x1e8], 1
mov dword [esp + 0x1ec], edi
mov dword [esp + 0x1f0], edi
mov dword [esp + 0x208], edi
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
lea ecx, [esp + 0x28]
push ecx
mov ecx, ebx
call edx
push edi
mov byte [esp + 0x20c], 1
mov ecx, dword [eax]
push esi
lea eax, [ebx + 0x28]
push eax
push edi
push ecx
mov eax, esp
mov dword [eax], ecx
lea ecx, [esp + 0xc0]
mov dword [esp + 0x28], esp
call fcn.00416a80
mov byte [esp + 0x208], 0
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x2c]
mov dword [esp + 0x14], eax
cmp ecx, edx
je 0x40307d
push ecx
call fcn.0048f6ed
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, edi
jne 0x40309c
push 0x10
push str.Duilib
push 0x804328
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push eax
mov edi, esi
call fcn.00406370
lea eax, [ebx + 0x20]
push eax
call fcn.00406dc0
mov eax, dword [ebx]
mov edx, dword [eax + 0x1c]
mov ecx, ebx
call edx
mov eax, dword [esp + 0xac]
test eax, eax
je 0x4030ca
push eax
call fcn.0048f6ed
add esp, 4
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x4030de
push eax
call fcn.0048f6ed
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x200]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1e8]
xor ecx, esp
call fcn.0048d1f2
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4036a0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor esi, esi
call edi
test ax, ax
jge 0x4036b8
mov esi, 8
push 2
call edi
test ax, ax
jge 0x4036c4
or esi, 1
push 1
call edi
test ax, ax
jge 0x4036d0
or esi, 2
push 0x10
call edi
test ax, ax
jge 0x4036dc
or esi, 4
push 0x12
call edi
test ax, ax
jge 0x4036e8
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x403f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x869088]
test eax, eax
jne 0x403f8e
mov eax, dword [0x869084]
movzx ecx, word [esp + 4]
push esi
push 0x804378
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x403ff7
mov eax, dword [0x869088]
test eax, eax
jne 0x403fb5
mov eax, dword [0x869084]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x403fef
mov eax, dword [0x869088]
test eax, eax
jne 0x403fd2
mov eax, dword [0x869084]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x403ff6
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.00404000
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
ret
Function at 0x404570
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
mov edi, eax
xor esi, esi
cmp dword [edi + 0x1c8], esi
jle 0x4045c4
jmp 0x404590
mov eax, dword [edi + 0x1c4]
mov byte [esp + 0x38], 0
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx]
mov edx, dword [edx]
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x40]
push eax
push ebp
push ebx
call edx
cmp byte [esp + 0x38], 0
jne 0x40473c
inc esi
cmp esi, dword [edi + 0x1c8]
jl 0x404590
sub ebx, 0x100
je 0x4046c1
sub ebx, 4
je 0x404644
sub ebx, 2
jne 0x4046b5
xor eax, eax
xor ecx, ecx
push ebp
mov word [esp + 0x3c], ax
mov word [esp + 0x3e], cx
call fcn.006d03fb
mov ecx, dword [edi + 0x144]
add esp, 4
mov word [esp + 0x38], ax
mov edx, dword [ecx]
mov edx, dword [edx + 0xfc]
push reloc.WS2_32.dll_ioctlsocket
lea eax, [esp + 0x3c]
push eax
push 0x407fa0
call edx
mov esi, eax
test esi, esi
je 0x4046b5
mov eax, dword [esi]
mov edx, dword [eax + 0xf0]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
cmp dword [edi + 0x148], 0
je 0x4046b5
mov ecx, dword [edi + 0x15c]
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 0x158]
mov dword [esp + 0x10], 6
mov word [esp + 0x24], bp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
call fcn.004036a0
mov word [esp + 0x26], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x148]
mov dword [esp + 0x18], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x108]
lea eax, [esp + 0x10]
push eax
call edx
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
cmp ebp, 9
jne 0x4046b5
cmp dword [edi + 0x148], 0
je 0x404725
mov ecx, dword [edi + 0x148]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc8]
call edx
test al, al
je 0x404725
mov ecx, dword [edi + 0x148]
mov eax, dword [ecx]
mov edx, dword [eax + 0xd4]
call edx
test al, al
je 0x404725
mov ecx, dword [edi + 0x148]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push str.RichEditUI
call edx
push eax
call fcn.006d0284
add esp, 8
test eax, eax
je 0x404725
mov eax, dword [edi + 0x148]
cmp byte [eax + 0x10a1], 0
jne 0x4046b5
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge cl
movzx edx, cl
push edx
call fcn.00406cf0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x20
ret 0xc