joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ca74
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x486be0], 0
je 0x43cbc3
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x485490]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x43cbc3
mov eax, dword [0x486be4]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x486be0]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x43cb92
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x486be0]
call fcn.0041a278
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x43cb8a
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x43cb8a
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x43cb8a
mov eax, dword [ebp - 0x14]
call fcn.004455d0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43cb8a
push ebp
call fcn.0043ca30
pop ecx
test al, al
jne 0x43cb8a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x43cb46
mov eax, dword [ebp - 0x14]
call fcn.00444164
dec eax
jle 0x43cb8a
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004036f0
cmp byte [ebp - 1], 0
je 0x43cb8a
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x43cb8a
mov edx, dword [ebp - 0x14]
mov eax, dword [0x486be4]
call fcn.0043c1f8
inc edi
dec ebx
jne 0x43cad9
mov eax, dword [0x486be4]
cmp dword [eax + 8], 0
jle 0x43cbaa
mov eax, dword [0x486be4]
call fcn.0043c288
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43cbc3
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0043c898
pop ecx
test al, al
jne 0x43cbc3
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43f5b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or esp, dword [esi + 0x458d6e89]
test al, 0x50
call fcn.0043f320
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0043f2d5
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
ror byte [ecx - 0x8b7b], cl
dec dword [ebx - 0xe0807bb]
Function at 0x43f5e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [ecx - 0x8b7b], cl
dec dword [ebx - 0xe0807bb]
test edx, edx
je 0x43f5fe
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0043f310
mov ebp, 0x8d161d1b
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x446bf6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x4855ec]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x446c9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0043ef70
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00440198
mov eax, dword [esi]
call fcn.0045d1f8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x446b4a
mov eax, dword [esi]
call fcn.0045d1f8
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.0045d204
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x446b6e
mov eax, dword [esi]
call fcn.0045d204
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.0045d1ec
cmp eax, dword [ebp - 0x18]
jle 0x446b84
mov eax, dword [esi]
call fcn.0045d1ec
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.0045d1e0
cmp eax, dword [ebp - 0xc]
jle 0x446b9a
mov eax, dword [esi]
call fcn.0045d1e0
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.004455d0
push eax
call sub.user32.dll_SetWindowPos
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x446c61
mov eax, ebx
call fcn.0040454c
cmp eax, 0x64
jge 0x446c61
cmp dword [0x484b3c], 0
je 0x446c61
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call sub.user32.dll_SystemParametersInfoA
cmp dword [ebp - 8], 0
je 0x446c61
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call sub.user32.dll_SystemParametersInfoA
cmp dword [ebp - 8], 0
je 0x446c24
mov bl, 2
jmp 0x446c3f
lea edx, [ebp - 0x20]
mov eax, dword [0x486b9c]
call fcn.00449d28
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x446c3d
xor ebx, ebx
jmp 0x446c3f
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x484c44]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.004455d0
push eax
call dword [0x484b3c]
push 4
mov eax, dword [ebp - 4]
call fcn.004455d0
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446ca6
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret
Function at 0x449e38
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x485610]
cmp byte [eax + 0xc], 0
je 0x449fa5
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x449f9e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x486bf0], 0
jne 0x449e8c
push 0x449fac
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x449fb4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486bf0], eax
cmp dword [0x484c6c], 0
jne 0x449f87
push 0x449fc4
call sub.kernel32.dll_LoadLibraryA
mov dword [0x484c6c], eax
cmp dword [0x484c6c], 0
je 0x449f87
push 0x449fd0
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486bf4], eax
push 0x449fe0
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486bf8], eax
push 0x449ff4
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486bfc], eax
push 0x44a00c
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486c00], eax
push 0x44a024
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486c04], eax
push 0x44a038
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486c08], eax
push 0x44a050
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486c0c], eax
push 0x44a068
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486c10], eax
push 0x44a084
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486c14], eax
push 0x44a090
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486c18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449fa5
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x44e6bc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404284
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x44e70b
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004044fc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4567b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4567ec]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4567cd
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4567dc
or bl, 4
test esi, 0x20000000
je 0x4567e7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x45cfa8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45cfba
add esp, 0xfffffff0
call fcn.00403858
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00422078
mov eax, dword [0x4852b8]
mov dword [eax + 4], ebx
mov dword [eax], 0x45d34c
mov eax, dword [0x4852c4]
mov dword [eax + 4], ebx
mov dword [eax], 0x45d358
mov eax, ebx
call fcn.0045d364
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x417a48]
call fcn.004034c4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x417a48]
call fcn.004034c4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x417a48]
call fcn.004034c4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x417a48]
call fcn.004034c4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x417a48]
call fcn.004034c4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45977c
push eax
push 0
push 0
mov eax, dword [0x485408]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x423abc]
call fcn.004251d0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x423abc]
call fcn.004251d0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x423abc]
call fcn.004251d0
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045d7cc
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45d6a8
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45d6a8
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45d6a8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45d0f7
call fcn.004038b0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45d48c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45d637
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45d618
mov dl, 1
mov eax, dword [0x4180ac]
call fcn.004034c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404284
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45d607
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044a198
test al, al
je 0x45d5fa
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45d648
lea eax, [ebp - 0x254]
call fcn.00409838
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45d5fa
xor eax, eax
push ebp
push 0x45d5f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45d680
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45d5dc
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044fc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45d5dc
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d5fa
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45d4fd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041c65c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d63e
lea eax, [ebp - 0x260]
call fcn.00404284
ret
Function at 0x45e778
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x486c38]
cmp dword [eax + 0x30], 0
je 0x45e822
cmp dword [ebx + 0x94], 0
jne 0x45e81c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45e708
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45e81c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45e7e2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45e81c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041a278
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45e7f1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45f2e8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45f31d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404374
jmp 0x45f32a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004042d8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4601bc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4601fd
mov eax, esi
call fcn.004458d4
test al, al
je 0x4601fd
mov eax, dword [ebx + 0x84]
call fcn.004455d0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4601fd
push 0
mov eax, dword [ebx + 0x84]
call fcn.004455d0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4640d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x464138
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044fc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408da4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46413f
lea eax, [ebp - 0xc]
call fcn.00404284
ret
Function at 0x4641b4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x464210
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4641df
call fcn.0040cc5c
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.004028fc
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x464210
call fcn.0040cc5c
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x46d33c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46d414
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x486f8c], 0
jne 0x46d3f8
lea eax, [ebp - 4]
mov edx, 0x46d42c
call fcn.0040431c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404744
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x46d3f8
mov eax, ebx
call fcn.00402720
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x46d3f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x46d3db
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x46d43c
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46d3db
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x486f8c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d3f8
mov eax, dword [ebp - 0xc]
call fcn.00402740
ret
mov ebx, dword [0x486f8c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d41b
lea eax, [ebp - 4]
call fcn.00404284
ret

Function at 0x47c88c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404284
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x47c8db
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004044fc
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408e54
nop
mov ecx, 0x53874ac3
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x6f82180
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x41ee30
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ad5ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004a205c
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x41eeb2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0049f978
mov eax, dword [eax]
push 0x4cdcac
push eax
call fcn.00491b14
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004a22e7
test bl, bl
je 0x41eeb2
push 0x4cdcac
lea ecx, [esp + 0xc]
call fcn.004a2677
push 0x4cdcb8
lea ecx, [esp + 0xc]
call fcn.004a2677
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41eeee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004a22e7
jmp 0x41efb9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41ef72
lea edx, [esp + 0x7c]
push 0x4cdcb4
push edx
call fcn.00491b14
add esp, 8
test eax, eax
je 0x41ef72
lea eax, [esp + 0x7c]
push 0x4cdcb0
push eax
call fcn.00491b14
add esp, 8
test eax, eax
je 0x41ef72
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41ef02
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004a22e7
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41f7b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41f812
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc