joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448d34
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x246c
call fcn.0044a1d0
mov eax, dword [0x46a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2428], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x242c], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x20]
mov dword [ebp - 0x241c], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x2430], eax
xor esi, esi
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x2420], eax
mov eax, dword [ebp + 0x1c]
push 0x3c
mov dword [ebp - 0x2424], eax
lea eax, [ebp - 0x246c]
push esi
push eax
call fcn.0042f8b0
add esp, 0xc
mov dword [ebp - 0x246c], 0x3c
cmp dword [ebp - 0x241c], esi
je 0x448dc6
lea eax, [ebp - 0x410]
mov dword [ebp - 0x2458], 0x101
mov dword [ebp - 0x245c], eax
mov ecx, 0x81
cmp dword [ebp - 0x2420], esi
je 0x448de5
lea eax, [ebp - 0x108]
mov dword [ebp - 0x244c], ecx
mov dword [ebp - 0x2450], eax
cmp dword [ebp - 0x2424], esi
je 0x448dff
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x2444], ecx
mov dword [ebp - 0x2448], eax
mov ecx, 0x801
test ebx, ebx
je 0x448e1a
lea eax, [ebp - 0x1414]
mov dword [ebp - 0x243c], ecx
mov dword [ebp - 0x2440], eax
test edi, edi
je 0x448e30
lea eax, [ebp - 0x2418]
mov dword [ebp - 0x2434], ecx
mov dword [ebp - 0x2438], eax
lea eax, [ebp - 0x246c]
push eax
push 0x90000000
push esi
push dword [ebp - 0x2428]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x448e7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x448e64
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x448e6b
mov esi, 0x80004005
push esi
push 0x56
push str.uriutil.cpp
call fcn.00403858
jmp 0x448f41
mov ecx, dword [ebp - 0x242c]
test ecx, ecx
je 0x448e8f
mov eax, dword [ebp - 0x2460]
mov dword [ecx], eax
mov eax, dword [ebp - 0x241c]
test eax, eax
je 0x448eb5
push dword [ebp - 0x2458]
push dword [ebp - 0x245c]
push eax
call fcn.0040221f
mov esi, eax
test esi, esi
js 0x448f41
mov eax, dword [ebp - 0x2430]
test eax, eax
je 0x448ec9
mov cx, word [ebp - 0x2454]
mov word [eax], cx
mov eax, dword [ebp - 0x2420]
test eax, eax
je 0x448eeb
push dword [ebp - 0x244c]
push dword [ebp - 0x2450]
push eax
call fcn.0040221f
mov esi, eax
test esi, esi
js 0x448f41
mov eax, dword [ebp - 0x2424]
test eax, eax
je 0x448f0d
push dword [ebp - 0x2444]
push dword [ebp - 0x2448]
push eax
call fcn.0040221f
mov esi, eax
test esi, esi
js 0x448f41
test ebx, ebx
je 0x448f29
push dword [ebp - 0x243c]
push dword [ebp - 0x2440]
push ebx
call fcn.0040221f
mov esi, eax
test esi, esi
js 0x448f41
test edi, edi
je 0x448f41
push dword [ebp - 0x2434]
push dword [ebp - 0x2438]
push edi
call fcn.0040221f
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dfc6
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4a17e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x4a1805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x4a1878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x4a183a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x4a186d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x4a186b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x4a1831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4a17fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x403894
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x494020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40392c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40390c
xor eax, eax
push ebp
push 0x403905
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403964
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40390c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x494020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x494020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404a70
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x496050], 0
je 0x404ad1
cmp word [0x49632c], 0xd7b2
jne 0x404a99
cmp dword [0x496334], 0
jbe 0x404a99
mov eax, 0x496328
call dword [0x496344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404afc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x49402c], 0
jne 0x404aed
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404c50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x494030], 0
je 0x404c76
mov edx, esi
mov eax, ebx
call dword [0x494030]
jmp 0x404c85
mov eax, 8
call fcn.00402f9c
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x496051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404c18
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x407250
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x408b94
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x498b2c
push 0xa
push 0x408c28
mov eax, dword [0x498b1c]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x408bb8
call fcn.0041086c
push ebx
mov eax, dword [0x498b1c]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x408bcf
call fcn.0041086c
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x408be1
call fcn.0041086c
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x498b30], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x498b34], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x498b38], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x498b3c], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x498b40], ecx
add edx, dword [eax + 0x14]
mov dword [0x498b44], edx
pop esi
pop ebx
ret

Function at 0x40a248
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40a2f1
test eax, edx
je 0x40a2f4
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40a271
push edx
mov edx, eax
mov eax, esp
call fcn.00405664
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40a287
push eax
lea eax, [esp + 8]
call fcn.00405664
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40a296
movzx eax, word [eax]
sub eax, ecx
jmp 0x40a2bd
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40a2d7
add ecx, 4
js 0x40a2ae
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40a2d4
push eax
mov eax, ecx
mov edx, 2
call fcn.00404cf0
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40a2bb
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40a2bd
xor eax, eax
ret
test eax, eax
je 0x40a304
test edx, edx
jne 0x40a258
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40e380
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40e3b9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.004055cc
jmp 0x40e3c2
mov eax, ebx
mov edx, esi
call fcn.00405490
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40e3cc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40e3ee
movzx eax, word [esp]
jmp 0x40e3f0
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40eb54
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffff004
push eax
add esp, 0xffffff7c
push 0x800
lea ecx, [esp + 0x88]
call fcn.0040e98c
mov eax, dword [0x495e44]
cmp byte [eax], 0
je 0x40ebe6
mov eax, dword [0x495c10]
call fcn.00403300
call fcn.00403104
lea eax, [esp + 0x884]
push eax
lea eax, [esp + 0x88]
push eax
call sub.user32.dll_CharToOemW
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x88c]
call fcn.0040b268
push eax
lea eax, [esp + 0x890]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40ec34
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ec1f
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x495bb4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x498b1c]
call fcn.00406598
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x8c]
push eax
push 0
call sub.user32.dll_MessageBoxW
add esp, 0x1084
ret

Function at 0x40f7fc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40f8d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004054e4
lea eax, [ebp - 4]
call fcn.00405d60
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040551c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x40f8bc
mov eax, ebx
call fcn.00402f9c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40f8b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040551c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x40f89f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40f8e4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x40f89f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f8bc
mov eax, dword [ebp - 0x10]
call fcn.00402fb8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f8d9
lea eax, [ebp - 4]
call fcn.00405480
ret
Function at 0x410714
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404f8c
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x4106be
mov eax, edi
add eax, eax
call fcn.00402f9c
mov esi, eax
jmp 0x4106c0
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4106f9
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4106e3
mov eax, esp
cmp esi, eax
je 0x410706
mov eax, esi
call fcn.00402fb8
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x410740
cmp bl, 0
je 0x41073c
cmp bl, 0x41
jl 0x410737
cmp bl, 0x5a
jg 0x410737
or bl, 0x20
xor al, bl
inc esi
jmp 0x41071b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x410680

Function at 0x41fecc
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041fbd0
dec esi
jne 0x41feee
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x421098
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x49ae60
cmp dword [edi], 0
jne 0x421114
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x49ae5c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x494c34
mov ecx, 2
call fcn.00403154
mov edx, 0x421070
lea eax, [esi + 5]
call fcn.00421090
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00421090
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4210e9
mov dword [0x49ae5c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x423eb8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040551c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
je 0x423f10
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x495f68]
mov dl, 1
mov eax, dword [0x423940]
call fcn.0040ed30
call fcn.004044f4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00423ac8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x424e50
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x424e56
ret
Function at 0x43ba7c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00405490
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x43bac3
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00405648
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x440edc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x441015
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x4239b4]
call fcn.00423af0
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x440feb
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00423b90
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.00405648
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x441030
call fcn.0040581c
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00423bf4
test al, al
je 0x440fd5
lea ecx, [ebp - 4]
mov edx, 0x4410a4
mov eax, dword [ebp - 0xc]
call fcn.00423e40
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00410ee8
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x440fce
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4410bc
mov eax, dword [ebp - 8]
push eax
call fcn.004079b8
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x4957ac]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440fd5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440ff2
mov eax, dword [ebp - 0xc]
call fcn.00403abc
ret

Function at 0x441120
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x441167
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44114a
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44115b
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x441167
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x446de4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x49b124], 0
je 0x446f25
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x495dd8]
mov edx, dword [edx]
xor al, byte [edx + 0xb8]
je 0x446f25
mov eax, dword [0x49b128]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x49b124]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x446ef4
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x49b124]
call fcn.0041913c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x446eec
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1e2], 0
je 0x446eec
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x446eec
mov eax, dword [ebp - 0x14]
call fcn.00451ff4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x446eec
push ebp
call fcn.00446da0
pop ecx
test al, al
jne 0x446eec
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403ccc
test al, al
je 0x446eec
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403ccc
cmp byte [ebp - 1], 0
je 0x446eec
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.00407638
test al, al
je 0x446eec
mov edx, dword [ebp - 0x14]
mov eax, dword [0x49b128]
call fcn.00446518
inc edi
dec ebx
jne 0x446e49
mov eax, dword [0x49b128]
cmp dword [eax + 8], 0
jle 0x446f0c
mov eax, dword [0x49b128]
call fcn.004465d0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x446f25
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00446c04
pop ecx
test al, al
jne 0x446f25
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ece0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00407620
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00449260
test ebx, ebx
jne 0x44ed33
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0044eb74
mov ebx, eax
test ebx, ebx
je 0x44ee1e
cmp esi, ebx
je 0x44ed5c
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x44ed71
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x44eda9
add eax, 0xffffff5f
sub eax, 2
jb 0x44edc1
dec eax
sub eax, 2
jb 0x44edd5
dec eax
sub eax, 2
jb 0x44edcb
jmp 0x44eddf
add eax, 0xfffffdff
sub eax, 2
jb 0x44edc1
dec eax
sub eax, 2
jb 0x44edd5
dec eax
sub eax, 2
jb 0x44edcb
jmp 0x44eddf
mov byte [esp + 0x120], 0
jmp 0x44ede7
mov byte [esp + 0x120], 2
jmp 0x44ede7
mov byte [esp + 0x120], 1
jmp 0x44ede7
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0045f538
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0044aa50
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x44ee20
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x45f040
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x45f061
test edi, 0x40000
je 0x45f07b
test bl, bl
jne 0x45f0fc
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x45f0fc
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x45f0ae
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x45f0c3
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x45f0d2
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x45f0e3
cmp byte [esp + 2], 0
je 0x45f0fc
cmp byte [esp + 2], 0
je 0x45f0f4
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x45f0fc
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x45f3a4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x45f3ca
mov eax, esp
push eax
push 0x45f36c
call sub.user32.dll_EnumWindows
jmp 0x45f3dd
mov eax, esp
push eax
push 0x45f34c
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x45f4a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x45f4f4]
test si, 4
je 0x45f4b5
or bl, 1
test si, 8
je 0x45f4bf
or bl, 4
test si, 1
je 0x45f4c9
or bl, 8
test si, 2
je 0x45f4d3
or bl, 0x10
test si, 0x10
je 0x45f4dd
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45f4ec
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45f4f8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x45f534]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45f512
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45f521
or bl, 4
test esi, 0x20000000
je 0x45f52c
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret