joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f76c
Capabilities:
Get graphical window text

Disassembly:
push 0x20
mov eax, 0x4bac76
call fcn.00441d06
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xd], bl
mov dword [ebp - 0x20], ebx
movzx eax, word [esi + 0xc]
movzx ecx, word [esi + 0xe]
add ecx, eax
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0xd]
mov dword [ebp - 0x18], ebx
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.0042f84f
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
push eax
lea eax, [esi + 0x1a]
mov dword [ebp - 4], ebx
push 0xd
push eax
call fcn.0043b246
pop ecx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
lea eax, [ebp - 0x20]
mov ecx, 0x533e4a
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0042f6d0
push eax
lea ecx, [ebp - 0x20]
call fcn.0042f69e
lea ecx, [ebp - 0x2c]
call fcn.0043239a
push dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
call fcn.004082c1
lea ecx, [ebp - 0x20]
call fcn.0043239a
mov eax, dword [ebp + 8]
call fcn.00441ce0
ret 8

Function at 0x42ff47
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebp, ebp
push edi
push ebp
push ebp
lea edi, [esi + 0x1a]
push 0xb8
push edi
call fcn.0043b246
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
pop ecx
push eax
call ebx
test eax, eax
je 0x42ffd7
test byte [esi + 0x18], 2
je 0x42ff9a
push 0x59
push str.Save_changes_
push ebp
push str.Notes_Modified
call fcn.0042c477
add esp, 0x10
cmp al, 0x59
je 0x42ff9a
push dword [esi + 0x14]
push edi
call fcn.0043b5ce
pop ecx
jmp 0x42ffc5
push dword [esi + 0x14]
movzx ecx, word [esi + 0xe]
movzx eax, word [esi + 0xc]
add ecx, eax
push ecx
push 0xd
push edi
call fcn.0043b246
pop ecx
push eax
call ebx
push esi
call fcn.004300a8
mov eax, dword [esi + 0x10]
pop ecx
test eax, eax
je 0x42ffc6
push esi
call eax
pop ecx
push ebp
push ebp
push 0xb9
push edi
call fcn.0043b246
pop ecx
push eax
call ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x43765d
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, dword [esp + 8]
movzx eax, byte [esp + 4]
sar ecx, 8
and ecx, 0xff00
push esi
mov esi, dword [esp + 0x10]
add cx, ax
mov eax, 0xf09
mov word [esi], cx
cmp cx, ax
jne 0x437698
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x437698
mov eax, 0xf00
mov word [esi], ax
xor eax, eax
inc eax
pop esi
ret

Function at 0x43769d
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x104
mov eax, dword [0x514d34]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
mov ebx, dword [esp + 0x114]
push ebp
mov ebp, dword [esp + 0x110]
cmp ebp, 0x70
jb 0x4376cb
cmp ebp, 0x79
jbe 0x4376de
push ebp
call fcn.0045d1c1
pop ecx
test ax, ax
jne 0x4376de
xor eax, eax
jmp 0x437780
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push ebp
call edi
push 2
mov esi, eax
push ebp
shl esi, 8
call edi
add eax, esi
mov ecx, 0x4800
mov word [ebx], ax
mov esi, 0x5000
mov ebp, 0x4b00
mov edi, 0x4d00
cmp ax, cx
je 0x437722
cmp ax, si
je 0x437722
cmp ax, bp
je 0x437722
cmp ax, di
jne 0x43777b
push 0x100
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00443240
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test byte [esp + 0x21], 0x80
je 0x43777b
movzx eax, word [ebx]
cmp eax, 0x4800
je 0x437773
cmp eax, ebp
je 0x43776c
cmp eax, edi
je 0x437765
cmp eax, esi
jne 0x43777b
mov eax, 0x9100
jmp 0x437778
mov eax, 0x7400
jmp 0x437778
mov eax, 0x7300
jmp 0x437778
mov eax, 0x8d00
mov word [ebx], ax
xor eax, eax
pop edi
inc eax
pop esi
mov ecx, dword [esp + 0x108]
pop ebp
pop ebx
xor ecx, esp
call fcn.00441a5e
add esp, 0x104
ret
Function at 0x439b83
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
cmp edi, 0x104
jne 0x439bef
cmp ebx, 0x12
jne 0x439c60
mov eax, dword [0x510504]
test eax, eax
je 0x439c60
cmp dword [eax], esi
je 0x439c60
push esi
push esi
push 0x129
push dword [eax]
call fcn.0042c80a
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
pop ecx
push eax
call ebp
test eax, eax
je 0x439c60
mov eax, dword [0x510504]
push esi
push 3
push 0x127
push dword [eax]
call fcn.0042c80a
pop ecx
push eax
call ebp
cmp edi, 0x100
jne 0x439c60
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebp
test al, al
jns 0x439c60
cmp ebx, 0x11
je 0x439c39
cmp ebx, 0x28
je 0x439c25
cmp ebx, 0x22
je 0x439c25
cmp ebx, 0x26
je 0x439c1e
cmp ebx, 0x21
jne 0x439c39
mov eax, 0x8d00
jmp 0x439c2a
mov eax, 0x9100
push eax
call fcn.0045d784
pop ecx
xor eax, eax
inc eax
jmp 0x439d8a
cmp ebx, 9
jne 0x439c60
push 0x10
call ebp
shr eax, 0xf
xor esi, esi
not eax
inc esi
and eax, esi
or eax, 0xfffc
push eax
call fcn.0045d784
pop ecx
mov ax, si
jmp 0x439d8a
mov edx, dword [0x533ec8]
test edx, edx
je 0x439d88
movzx eax, word [edx]
test ax, ax
je 0x439d88
mov ebp, 0x104
cmp edi, ebp
je 0x439c8f
cmp edi, 0x106
jne 0x439d88
xor ecx, ecx
cmp cx, ax
jae 0x439cb4
call dword [sym.imp.USER32.dll_GetFocus]
mov edx, dword [0x533ec8]
movzx ecx, si
imul ecx, ecx, 5
cmp dword [ecx + edx + 3], eax
je 0x439cb4
inc esi
cmp si, word [edx]
jb 0x439c96
xor eax, eax
cmp si, word [edx]
cmove esi, eax
cmp edi, ebp
jne 0x439ccb
push 2
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov bl, al
push ebx
call fcn.0040813e
pop ecx
lea ecx, [esi + 1]
mov dl, al
movzx ebx, cx
mov ecx, dword [0x533ec8]
mov byte [esp + 0x14], dl
xor eax, eax
cmp bx, word [ecx]
cmove ebx, eax
cmp bx, si
je 0x439d3a
movzx eax, bx
imul ebp, eax, 5
cmp byte [ecx + ebp + 2], dl
jne 0x439d2d
push dword [ecx + ebp + 3]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x439d23
mov eax, dword [0x533ec8]
push 0xfffffffffffffff0
push dword [eax + ebp + 3]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
jne 0x439d30
mov ecx, dword [0x533ec8]
mov dl, byte [esp + 0x14]
inc ebx
jmp 0x439ce4
mov ecx, dword [0x533ec8]
mov dl, byte [esp + 0x14]
movzx eax, bx
imul esi, eax, 5
cmp byte [esi + ecx + 2], dl
jne 0x439d88
cmp edi, 0x104
jne 0x439d7c
push dword [esi + ecx + 3]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [0x533ec8]
push dword [esi + eax + 3]
push 4
call fcn.0043b5ec
pop ecx
pop ecx
test eax, eax
je 0x439c31
push 0x3920
jmp 0x439c2b
cmp edi, 0x106
je 0x439c31
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x43b2fa
Capabilities:
Set global application hook

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x43f971
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x533f0c], eax
ret
Function at 0x43b316
Capabilities:
Set global application hook

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x43c81c
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x533f10], eax
ret

Function at 0x43bc77
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
cmp word [0x533f44], 0
je 0x43bcd9
push ebx
push esi
push dword [ebp + 0xc]
call fcn.00447230
inc eax
movzx esi, ax
push esi
call fcn.00441cd2
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x43bcd0
push ebx
push esi
push 0xd
push dword [ebp + 8]
call fcn.0043b246
pop ecx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp + 0xc]
push ebx
call fcn.004478d0
neg eax
push ebx
sbb eax, eax
inc eax
movzx esi, ax
call fcn.00441cdb
add esp, 0xc
jmp 0x43bcd2
xor esi, esi
test si, si
pop esi
pop ebx
jne 0x43bcf0
push dword [ebp + 0xc]
push 0
push 0xc
push dword [ebp + 8]
call fcn.0043b246
pop ecx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp + 8]
call fcn.0043c2dc
pop ecx
pop ebp
ret

Function at 0x43bd2c
Capabilities:
Get graphical window text

Disassembly:
movzx eax, word [esp + 0xc]
push eax
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0043b246
pop ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
ret

Function at 0x43bd95
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
cmp word [0x533f44], 0
je 0x43be07
push ebx
push esi
push dword [ebp + 0xc]
call fcn.0044769f
inc eax
xor ecx, ecx
movzx esi, ax
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00441cd2
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x43bdfe
push ebx
push esi
push 0xd
push dword [ebp + 8]
call fcn.0043b246
pop ecx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp + 0xc]
push ebx
call fcn.0044b0e2
neg eax
push ebx
sbb eax, eax
inc eax
movzx esi, ax
call fcn.00441cdb
add esp, 0xc
jmp 0x43be00
xor esi, esi
test si, si
pop esi
pop ebx
jne 0x43be1e
push dword [ebp + 0xc]
push 0
push 0xc
push dword [ebp + 8]
call fcn.0043b246
pop ecx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp + 8]
call fcn.0043c2dc
pop ecx
pop ebp
ret

Function at 0x43be29
Capabilities:
Get graphical window text

Disassembly:
movzx eax, word [esp + 0xc]
push eax
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0043b246
pop ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
ret
Function at 0x43c421
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x424
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp + 0x70], eax
push esi
mov esi, dword [ebp + 0x7c]
push str.http:__
push esi
call fcn.0040a4e2
pop ecx
pop ecx
test ax, ax
je 0x43c47a
push str.https:__
push esi
call fcn.0040a4e2
pop ecx
pop ecx
test ax, ax
je 0x43c47a
push esi
call fcn.0040d5d3
pop ecx
test ax, ax
jne 0x43c47a
push str.Help_file_not_Found
call fcn.00413845
pop ecx
jmp 0x43c60e
movzx eax, byte [0x533f4e]
push ebx
xor ebx, ebx
sub eax, ebx
je 0x43c5e3
sub eax, 1
je 0x43c49b
push str.Internet_access_denied
jmp 0x43c607
push edi
lea ecx, [ebp - 0xcc]
call fcn.00439601
movaps xmm0, xmmword [0x4ccea0]
lea edi, [ebp + 0x1a]
xor eax, eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x56], eax
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0xcc]
mov dword [ebp - 0x10], eax
xor eax, eax
movups xmmword [ebp - 0x70], xmm0
mov word [ebp - 0x5c], 0x5a4b
mov dword [ebp - 0x5a], ebx
xorps xmm0, xmm0
movups xmmword [ebp - 0x26], xmm0
mov dword [ebp - 0x52], ebx
mov dword [ebp - 0x4e], 1
mov dword [ebp - 0x4a], ebx
mov dword [ebp - 0x46], 0x431a31
mov dword [ebp - 0x42], ebx
mov dword [ebp - 0x3e], ebx
mov dword [ebp - 0x3a], ebx
mov dword [ebp - 0x36], ebx
mov word [ebp - 0x32], bx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2a], ebx
mov dword [ebp - 0x16], ebx
mov word [ebp - 0x12], 0x5a4b
mov dword [ebp - 0xc], 0x2ee
mov dword [ebp - 8], 0x15e
mov dword [ebp - 4], ebx
mov dword [ebp], 0x43c3f1
mov dword [ebp + 4], 0x439892
mov dword [ebp + 8], 0x4a1004
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
mov word [ebp + 0x18], bx
stosd dword es:[edi], eax
push 0x2dd
push ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp + 0x3e], eax
lea edi, [ebp + 0x64]
movups xmmword [ebp + 0x24], xmm0
mov dword [ebp + 0x34], ebx
mov word [ebp + 0x38], 0x5a4b
mov dword [ebp + 0x3a], ebx
mov dword [ebp + 0x42], str.Close0
mov dword [ebp + 0x46], 0x100
mov dword [ebp + 0x4a], ebx
mov dword [ebp + 0x4e], 0x42ceba
mov dword [ebp + 0x52], ebx
mov dword [ebp + 0x56], ebx
mov dword [ebp + 0x5a], ebx
mov dword [ebp + 0x5e], ebx
mov word [ebp + 0x62], bx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x70]
mov dword [ebp - 0x3b0], eax
mov eax, 0xde
mov word [ebp - 0x3ac], ax
lea eax, [ebp - 0x3aa]
push eax
call fcn.00443240
add esp, 0xc
lea ecx, [ebp - 0xcc]
push ebx
push ebx
push esi
call fcn.004397da
lea eax, [ebp - 0x3b0]
push 0x4c060e
push eax
call fcn.00421d32
pop ecx
pop ecx
lea ecx, [ebp - 0xcc]
call fcn.00432375
pop edi
jmp 0x43c60d
mov eax, dword [0x50d248]
push 0xa
push ebx
push ebx
mov eax, dword [eax]
push esi
push str.open
push dword [eax]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp ax, 0x20
jae 0x43c60d
push str.Unable_to_Display_HTML_Help
call fcn.00413845
pop ecx
pop ebx
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
pop esi
call fcn.00441a5e
lea esp, [ebp + 0x74]
pop ebp
ret
Function at 0x43cf75
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 4], 0x100
jne 0x43cfcb
cmp dword [eax + 8], 9
jne 0x43cfcb
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
call esi
push 0xffffffffffffff80
pop edi
push 0x10
test di, ax
je 0x43cfaf
call esi
and ax, di
cwde
neg eax
sbb eax, eax
add eax, 0xfffd
jmp 0x43cfc2
call esi
test di, ax
mov eax, 0xf09
lea ecx, [eax - 9]
cmovne eax, ecx
movzx eax, ax
push eax
call fcn.0045d784
pop ecx
pop edi
pop esi
xor eax, eax
ret 0xc

Function at 0x43d3bb
Capabilities:
Get file version info

Disassembly:
sub esp, 0x144
mov eax, dword [0x514d34]
xor eax, esp
mov dword [esp + 0x140], eax
cmp dword [0x533f6c], 0
jne 0x43d50c
push ebx
push ebp
push esi
push edi
push 0xa
mov dword [esp + 0x12c], str.rmpHTML.ocx
lea esi, [esp + 0x12c]
mov dword [esp + 0x130], str.stdole2.tlb
mov dword [esp + 0x134], str.msvbvm60.dll
mov dword [esp + 0x138], str.oleaut32.dll
mov dword [esp + 0x13c], str.olepro32.dll
mov dword [esp + 0x140], str.asycfilt.dll
mov dword [esp + 0x144], str.comcat.dll
mov dword [esp + 0x148], str.richtx32.ocx
mov dword [esp + 0x14c], str.mscomctl.ocx
mov dword [esp + 0x150], str.comct332.ocx
pop ebx
push 0x10c
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00443240
push dword [esi]
lea eax, [esp + 0x2c]
push eax
call fcn.00446f90
and dword [esp + 0x24], 0
lea eax, [esp + 0x24]
add esp, 0x14
push eax
lea eax, [esp + 0x20]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebp, eax
test ebp, ebp
je 0x43d4ed
push ebp
call fcn.00441cd2
pop ecx
mov edi, eax
lea eax, [esp + 0x1c]
push edi
push ebp
push dword [esp + 0x18]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x43d4e6
and dword [esp + 0x18], 0
lea eax, [esp + 0x18]
and dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x18]
push eax
push 0x4c1278
push edi
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 8]
mov dword [esp + 0x120], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x124], eax
push edi
call fcn.00441cdb
pop ecx
lea eax, [esp + 0x1c]
mov ecx, 0x533f5c
push eax
call fcn.0043d987
add esi, 4
sub ebx, 1
jne 0x43d458
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.00441a5e
add esp, 0x144
ret

Function at 0x43d8de
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffeb
push dword [esp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, eax
je 0x43d8f5
mov ecx, eax
jmp fcn.0043dd2d
ret
Function at 0x43dd2d
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x20], 0
je 0x43dd7d
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x20]
push edx
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
je 0x43dd7d
push str.Resize_failed___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00441a5e
mov esp, ebp
pop ebp
ret
Function at 0x43f762
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x4baf7f
call fcn.00441d3a
mov eax, dword [ebp + 8]
xor esi, esi
push 0xffffffffffffffeb
push eax
call fcn.0043b246
pop ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, eax
je 0x43f827
mov ecx, eax
call fcn.00440577
mov ecx, eax
test ecx, ecx
je 0x43f827
mov eax, dword [ecx]
lea edx, [ebp - 0x30]
and dword [ebp - 0x30], esi
push edx
push 0x4cdac0
push ecx
call dword [eax]
test eax, eax
jne 0x43f827
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x43f827
mov eax, dword [ecx]
lea edx, [ebp - 0x2c]
push edx
push ecx
call dword [eax + 0x7c]
test eax, eax
jne 0x43f81e
xor ebx, ebx
lea ecx, [ebp - 0x28]
or eax, 0xffffffff
inc ebx
cmp word [ebp - 0x2c], ax
cmove esi, ebx
call fcn.00408368
mov ecx, eax
and dword [ebp - 4], 0
mov edx, 0x4bff80
test si, si
mov eax, 0x4ca558
cmove eax, edx
push eax
push str.IsBusy___str___n
push ecx
call fcn.00408abf
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x43f808
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push ebx
call fcn.0040758b
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ax, si
call fcn.00441cf5
ret

Function at 0x43f936
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
cmp dword [eax + 4], 0x100
jne 0x43f96d
mov eax, dword [eax + 8]
xor esi, esi
inc esi
cmp eax, 8
jb 0x43f960
cmp eax, 9
jbe 0x43f95b
add eax, 0xffffffd3
cmp eax, esi
ja 0x43f960
mov ax, si
pop esi
ret
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x43f95b
xor eax, eax
pop esi
ret
Function at 0x43fad2
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
sub esp, 0x864
lea ebp, [esp - 4]
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp + 0x864], eax
push 0x1c
mov eax, 0x4bafac
call fcn.00441d06
xor edi, edi
lea ecx, [ebp + 0x20]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], edi
call fcn.00408368
lea eax, [ebp + 0x20]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00440c0c
add esp, 0xc
test ax, ax
je 0x43fc39
cmp dword [ebp - 0x14], 8
jb 0x43fc39
push edi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp]
call fcn.0046f790
mov ecx, eax
call fcn.0046f7ba
push eax
push 3
push edi
push edi
push edi
push str.SOFTWAREMicrosoftInternet_ExplorerMAINFeatureControlFEATURE_BROWSER_EMULATION
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x43fc39
mov esi, 0x519
lea eax, [ebp + 0x38]
push esi
push edi
push eax
call fcn.00443240
add esp, 0xc
lea eax, [ebp + 0x38]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x43fc39
push 0x30f
lea eax, [ebp + 0x554]
push edi
push eax
call fcn.00443240
lea eax, [ebp + 0x554]
push eax
lea eax, [ebp + 0x38]
push eax
call fcn.0040dc9b
add esp, 0x14
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], edi
mov esi, 0x22b8
mov dword [ebp - 0x28], esi
push 4
pop ebx
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], ebx
push eax
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp + 0x554]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43fbf3
cmp dword [ebp - 0x18], esi
jb 0x43fbf3
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43fc6e
push dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 0x10]
push eax
push 3
push edi
push str.SOFTWAREMicrosoftInternet_ExplorerMAINFeatureControlFEATURE_BROWSER_EMULATION
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43fc39
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push edi
lea eax, [ebp + 0x554]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10]
test eax, eax
je 0x43fc6c
call esi
mov esi, edi
push edi
push 1
lea ecx, [ebp + 0x20]
call fcn.0040758b
mov ax, si
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x864]
xor ecx, ebp
call fcn.00441a5e
lea esp, [ebp + 0x868]
pop ebp
ret
call esi
xor esi, esi
inc esi
jmp 0x43fc3b

Function at 0x4404d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 4], 0x100
jne 0x440523
cmp dword [eax + 8], 9
jne 0x440523
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
push 0x10
test ax, ax
jns 0x440508
call esi
xor ecx, ecx
test ax, ax
setns cl
add ecx, 0xfffc
push ecx
jmp 0x44051c
call esi
mov ecx, 0xf09
test ax, ax
lea edx, [ecx - 9]
cmovs ecx, edx
movzx eax, cx
push eax
call fcn.0045d784
pop ecx
pop esi
xor eax, eax
ret 0xc
Function at 0x440c0c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x418
lea ebp, [esp - 4]
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp + 0x418], eax
push 0x34
mov eax, 0x4bb044
call fcn.00441d06
mov eax, dword [ebp + 0x424]
xor esi, esi
mov ebx, dword [ebp + 0x428]
inc esi
mov edi, dword [ebp + 0x42c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x440ca0
test edi, edi
je 0x440c99
xor ebx, ebx
lea eax, [ebp]
push ebx
push eax
call fcn.00410f56
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], ebx
jb 0x440c80
mov eax, dword [eax]
push eax
push str.Failed_to_open_access_to_the_registry_key_HKLMSOFTWAREMicrosoftInternet_Explorer__n_nError_message:__str_
push edi
call fcn.00409029
add esp, 0xc
lea ecx, [ebp]
push ebx
push esi
call fcn.0040758b
xor eax, eax
jmp 0x440de4
push 0x400
lea eax, [ebp + 0x18]
push 0
push eax
call fcn.00443240
add esp, 0xc
mov dword [ebp - 0x20], 0x400
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x18]
push eax
push 0
push 0
push str.Version
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x440d19
test edi, edi
je 0x440d0e
lea eax, [ebp]
push 0
push eax
call fcn.00410f56
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], esi
jb 0x440cf4
mov eax, dword [eax]
push eax
push str.Failed_to_query_for_the_the_IE_version__n_nError_message:__str_
push edi
call fcn.00409029
add esp, 0xc
lea ecx, [ebp]
push 0
push esi
call fcn.0040758b
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x440c99
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call fcn.00485bcb
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x24]
lea eax, [ebp - 0xd]
mov dword [ebp - 4], 2
push eax
push edi
lea eax, [ebp - 0x40]
mov byte [ebp - 0xd], 0x2e
push eax
lea ecx, [ebp - 0x1c]
call fcn.0044072e
lea ecx, [ebp - 0x38]
call fcn.00466577
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x1c]
push eax
push 5
push esi
push dword [ebp - 0x20]
lea eax, [ebp + 0x18]
push eax
call fcn.0045c1ef
add esp, 0x18
cmp dword [ebp - 0x28], esi
jb 0x440dcf
push edi
lea ecx, [ebp - 0x38]
call fcn.0042a316
cmp dword [eax + 0x14], 0x10
jb 0x440d90
mov eax, dword [eax]
push dword [ebp - 0x24]
push 5
push eax
call fcn.004097f9
add esp, 0xc
test ax, ax
jne 0x440dcf
cmp dword [ebp - 0x28], 2
jb 0x440dcb
push esi
lea ecx, [ebp - 0x38]
call fcn.0042a316
cmp dword [eax + 0x14], 0x10
jb 0x440dba
mov eax, dword [eax]
push ebx
push 5
push eax
call fcn.004097f9
add esp, 0xc
test ax, ax
je 0x440dd1
mov dword [ebx], edi
jmp 0x440dd1
mov esi, edi
lea ecx, [ebp - 0x38]
call fcn.00440809
lea ecx, [ebp - 0x1c]
call fcn.004407e5
mov ax, si
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x418]
xor ecx, ebp
call fcn.00441a5e
lea esp, [ebp + 0x41c]
pop ebp
ret