joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4377f0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x1c
push esi
push edi
mov edi, dword [esp + 0x30]
test di, di
jne 0x437803
mov edi, 1
mov esi, dword [esp + 0x28]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov dword [esp + 8], 1
mov dword [esp + 0x18], eax
mov word [esp + 0xc], si
movsx ecx, si
mov dword [esp + 0x1c], eax
push eax
push ecx
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [esp + 0xe], ax
movsx eax, word [esp + 0x2c]
sub eax, 0
je 0x437888
dec eax
je 0x43786d
dec eax
jne 0x4378ce
call fcn.0044afd0
mov edx, dword [eax]
movsx ecx, di
push ecx
push esi
push 6
mov ecx, eax
call dword [edx + 4]
pop edi
pop esi
add esp, 0x1c
ret 0xc
call fcn.0044a6f0
mov edx, dword [eax]
movsx ecx, di
push ecx
push esi
push 3
mov ecx, eax
call dword [edx + 4]
pop edi
pop esi
add esp, 0x1c
ret 0xc
movsx esi, di
test esi, esi
jbe 0x4378ce
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 8]
push 0x1c
push edx
push 1
mov dword [esp + 0x1c], 0
call fcn.0043ae10
add esp, 0xc
push 0x32
call edi
lea eax, [esp + 8]
push 0x1c
push eax
push 1
mov dword [esp + 0x1c], 2
call fcn.0043ae10
add esp, 0xc
dec esi
jne 0x437895
pop edi
pop esi
add esp, 0x1c
ret 0xc

Function at 0x4378e0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x1c
push esi
push edi
mov edi, dword [esp + 0x30]
test di, di
jne 0x4378f3
mov edi, 1
mov esi, dword [esp + 0x28]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov dword [esp + 8], 1
mov dword [esp + 0x18], eax
mov word [esp + 0xc], si
movsx ecx, si
mov dword [esp + 0x1c], eax
push eax
push ecx
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [esp + 0xe], ax
movsx eax, word [esp + 0x2c]
sub eax, 0
je 0x437978
dec eax
je 0x43795d
dec eax
jne 0x437995
call fcn.0044afd0
mov edx, dword [eax]
movsx ecx, di
push ecx
push esi
push 7
mov ecx, eax
call dword [edx + 4]
pop edi
pop esi
add esp, 0x1c
ret 0xc
call fcn.0044a6f0
mov edx, dword [eax]
movsx ecx, di
push ecx
push esi
push 4
mov ecx, eax
call dword [edx + 4]
pop edi
pop esi
add esp, 0x1c
ret 0xc
movsx eax, di
test eax, eax
jbe 0x437995
mov esi, eax
lea edx, [esp + 8]
push 0x1c
push edx
push 1
call fcn.0043ae10
add esp, 0xc
dec esi
jne 0x437981
pop edi
pop esi
add esp, 0x1c
ret 0xc
Function at 0x4379a0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x1c
push esi
push edi
mov edi, dword [esp + 0x30]
test di, di
jne 0x4379b3
mov edi, 1
mov esi, dword [esp + 0x28]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov dword [esp + 8], 1
mov dword [esp + 0x18], eax
mov word [esp + 0xc], si
movsx ecx, si
mov dword [esp + 0x1c], eax
push eax
push ecx
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [esp + 0xe], ax
mov dword [esp + 0x10], 2
movsx eax, word [esp + 0x2c]
sub eax, 0
je 0x437a40
dec eax
je 0x437a25
dec eax
jne 0x437a5d
call fcn.0044afd0
mov edx, dword [eax]
movsx ecx, di
push ecx
push esi
push 8
mov ecx, eax
call dword [edx + 4]
pop edi
pop esi
add esp, 0x1c
ret 0xc
call fcn.0044a6f0
mov edx, dword [eax]
movsx ecx, di
push ecx
push esi
push 5
mov ecx, eax
call dword [edx + 4]
pop edi
pop esi
add esp, 0x1c
ret 0xc
movsx eax, di
test eax, eax
jbe 0x437a5d
mov esi, eax
lea edx, [esp + 8]
push 0x1c
push edx
push 1
call fcn.0043ae10
add esp, 0xc
dec esi
jne 0x437a49
pop edi
pop esi
add esp, 0x1c
ret 0xc
Function at 0x4381d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x474f30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x24]
push ebx
push esi
push edi
mov edi, ecx
push eax
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString_3
mov bl, 1
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], bl
call sub.MFC42.DLL_CString::TrimLeft
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::TrimRight
push 0x20
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::Find_2
test eax, eax
jle 0x4382ab
mov ecx, dword [esp + 0x30]
push 0x20
mov esi, dword [ecx - 8]
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::Find_2
sub esi, eax
lea edx, [esp + 0x10]
dec esi
lea ecx, [esp + 0x30]
push esi
push edx
call sub.MFC42.DLL_CString::Right
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call sub.MFC42.DLL_CString::CString
push 0x20
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::Find_2
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call sub.MFC42.DLL_CString::CString
jmp 0x4382b9
push 0x4d6560
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call sub.MFC42.DLL_CString::CString_2
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x34], 4
call sub.MFC42.DLL_CString::CString_2
mov edx, dword [edi + 0x24]
push ecx
add edx, 0x30
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
mov byte [esp + 0x38], 5
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0x34], bl
call fcn.00436d30
add esp, 0xc
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 4
Function at 0x438410
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474f70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
call sub.MFC42.DLL_CString::CString_3
xor ebx, ebx
push str.CStr_
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::operator
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push eax
call fcn.0042022c
push 0x4d3934
lea ecx, [ebp - 0x14]
call fcn.0042022c
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x20], esp
push edx
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esi + 0x20]
lea eax, [ebp - 0x30]
push eax
call fcn.0043c5b0
mov ecx, dword [eax + 8]
push ecx
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::operator_2
jmp 0x4384ad
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 3
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea ecx, [ebp - 0x18]
push str.Thread:_d____s
push ecx
call sub.MFC42.DLL_CString::Format_1
mov edx, dword [ebp - 0x18]
add esp, 0x10
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0x24]
cmp dword [eax + 0x40], ebx
je 0x43850b
push ebx
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::GetBuffer
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x24]
inc ecx
push eax
mov eax, dword [edx + 0x40]
push ecx
push 0xc9
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43a040
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x475110
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
push eax
call fcn.00415d00
add esp, 4
push str.temp01.dll
lea ecx, [esp + 0x14]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
mov ebx, dword [sym.imp.MSVCRT.dll_fopen]
push 0x4d2830
push eax
call ebx
add esp, 8
lea ecx, [esp + 0x10]
mov esi, eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ebp, dword [sym.imp.MSVCRT.dll_fputc]
cmp esi, edi
je 0x43a0e7
mov eax, dword [0x4d3990]
test eax, eax
jbe 0x43a0dd
xor edx, edx
push esi
mov dl, byte [edi + 0x49f198]
xor edx, 0x7d
push edx
call ebp
mov eax, dword [0x4d3990]
add esp, 8
inc edi
cmp edi, eax
jb 0x43a0c1
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea eax, [esp + 0x1c]
push eax
call fcn.00415d00
add esp, 4
push str.temp02.dll
lea ecx, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x34], 1
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push 0x4d2830
push eax
call ebx
add esp, 8
lea ecx, [esp + 0x18]
mov edi, eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
test edi, edi
je 0x43a16a
mov eax, dword [0x4d3994]
xor esi, esi
test eax, eax
jbe 0x43a160
xor edx, edx
push edi
mov dl, byte [esi + 0x4a9198]
xor edx, 0x7d
push edx
call ebp
mov eax, dword [0x4d3994]
add esp, 8
inc esi
cmp esi, eax
jb 0x43a144
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x43aac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4752bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [esp + 0x38]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.0043a8c0
lea ecx, [esp + 8]
mov dword [esp + 0x30], 1
call fcn.0043a9a0
mov esi, dword [esp + 0x38]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 4], 1
lea ecx, [esp + 8]
mov byte [esp + 0x30], 0
call fcn.0043a940
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x43ac70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.NtProtectVirtualMemory
push str.NTDLL.DLL
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.ZwDeviceIoControlFile
push str.NTDLL.DLL
mov ebx, eax
call esi
push eax
call edi
push 0
push ebx
mov esi, eax
call fcn.0043ad40
push 1
push esi
call fcn.0043ad40
mov eax, dword [sym.imp.USER32.dll_SetCursorPos]
push 2
push eax
call fcn.0043ad40
mov ecx, dword [sym.imp.USER32.dll_SendInput]
push 3
push ecx
call fcn.0043ad40
mov edx, dword [sym.imp.USER32.dll_GetCursorPos]
push 4
push edx
call fcn.0043ad40
mov eax, dword [sym.imp.GDI32.dll_GetPixel]
push 5
push eax
call fcn.0043ad40
mov ecx, dword [sym.imp.GDI32.dll_GetDIBits]
push 6
push ecx
call fcn.0043ad40
mov edx, dword [sym.imp.GDI32.dll_BitBlt]
push 7
push edx
call fcn.0043ad40
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
add esp, 0x40
push 8
push eax
call fcn.0043ad40
add esp, 8
lea ecx, [esp + 0xc]
push ecx
push 0x40
push 0x400
push 0x4d6b1c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.00448270
push fcn.0043ae50
call dword [eax + 0x44]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43d600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x475668
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [esp + 0x30]
test esi, esi
je 0x43d643
mov eax, dword [esi]
jmp 0x43d645
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
push eax
push edi
call dword [ecx + 0x6c]
test eax, eax
jge 0x43d661
push 0x4d3b18
push edi
push eax
call fcn.0046f78a
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, edi
test esi, esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov word [esp + 0xc], 0
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
je 0x43d6c1
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x43d6c1
mov eax, dword [esi]
test eax, eax
je 0x43d6a8
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x43d6b8
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x43e4f0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x475964
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [esp + 0x34]
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call sub.MFC42.DLL_CString::CString_2
lea eax, [edi + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString_2
lea ecx, [edi + 8]
mov byte [esp + 0x2c], 1
push ecx
lea ecx, [esi + 8]
call sub.MFC42.DLL_CString::CString_2
lea edx, [edi + 0xc]
lea ecx, [esi + 0xc]
push edx
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [edi + 0x10]
lea ebx, [esi + 0x18]
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov ecx, ebx
mov byte [esp + 0x2c], 3
mov dword [esp + 0x34], ebx
call sub.MFC42.DLL_CStringArray::CStringArray
lea edx, [edi + 0x18]
mov ecx, ebx
push edx
mov byte [esp + 0x30], 4
mov dword [ebx], 0x479fa0
call sub.MFC42.DLL_CStringArray::Copy
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x479fa0
call fcn.0042071e
lea ebx, [esi + 0x2c]
mov byte [esp + 0x2c], 5
mov ecx, ebx
mov dword [esp + 0x34], ebx
call sub.MFC42.DLL_CStringArray::CStringArray
add edi, 0x2c
mov ecx, ebx
push edi
mov byte [esp + 0x30], 6
mov dword [ebx], 0x479fa0
call sub.MFC42.DLL_CStringArray::Copy
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x479fa0
call fcn.0042071e
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x444250
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x475c3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.00444370
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x4d6560
call dword [sym.imp.MSVCRT.dll_public:_void___thiscall_exception::constructor_char_const__const_const__]
mov al, byte [esi]
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov byte [esp + 0x24], al
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov edx, dword [ecx]
lea ecx, [esp + 0x24]
push edx
push ebx
push esi
mov byte [esp + 0x48], 1
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov eax, dword [sym.imp.MSVCP60.dll_const_std::runtime_error::vftable]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x4442fb
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4442f2
cmp al, 0xff
je 0x4442f2
dec al
mov byte [ecx], al
jmp 0x4442fb
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.0046deb0
mov eax, dword [esp + 0x28]
mov ecx, dword [sym.imp.MSVCP60.dll_const_std::runtime_error::vftable]
cmp eax, ebx
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x18], ecx
je 0x444347
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x44433e
cmp al, 0xff
je 0x44433e
dec al
mov byte [ecx], al
jmp 0x444347
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.MSVCRT.dll_public_virtual:_void___thiscall_exception::destructor_void_]
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x4460b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x475d16
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
mov eax, 0xa
push edi
mov dword [esp + 0x18], esi
mov dword [esi + 8], 0x4b567c
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [esp + 0x24], ebx
mov dword [esi + 0x24], 0x4b5668
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], 0x11
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], eax
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x13]
push 0x14
mov byte [esp + 0x28], 1
mov byte [esi + 0x40], al
mov byte [esi + 0x41], cl
mov byte [esi + 0x48], bl
call sub.MFC42.DLL_operatornew
mov edi, eax
add esp, 4
lea ecx, [esp + 0x14]
mov ebp, edi
mov dword [edi + 4], ebx
mov dword [edi + 0x10], 1
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
cmp dword [0x4d6dbc], ebx
jne 0x446166
mov dword [0x4d6dbc], edi
mov dword [edi], ebx
mov edx, dword [0x4d6dbc]
xor ebp, ebp
mov dword [edx + 8], ebx
mov ecx, dword [0x4d6db8]
inc ecx
mov dword [0x4d6db8], ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
cmp ebp, ebx
je 0x44618a
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
mov edi, dword [0x4d6dbc]
push 0x14
call sub.MFC42.DLL_operatornew
mov dword [eax + 4], edi
mov dword [eax + 0x10], ebx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x44]
add esp, 4
mov dword [eax + 8], eax
mov dword [esi], 0x4b5664
mov dword [esi + 4], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x446ce0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call esi
mov bx, word [esp + 0xc]
mov cl, bl
sar eax, 0xf
shr cl, 2
and eax, 1
and ecx, 1
xor eax, ecx
test ax, ax
je 0x446d0b
pop esi
xor eax, eax
pop ebx
ret
push 0x11
call esi
mov dl, bl
sar eax, 0xf
shr dl, 1
and eax, 1
and edx, 1
xor eax, edx
test ax, ax
je 0x446d28
pop esi
xor eax, eax
pop ebx
ret
push 0x10
call esi
sar eax, 0xf
and eax, 0xffff
and ebx, 0xffff
not eax
xor eax, ebx
pop esi
and eax, 1
pop ebx
ret

Function at 0x446e60
Capabilities:
Set global application hook

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
je 0x446ea9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
push 0x446d90
push 0
call esi
mov dword [0x4d6dac], eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x446ec8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x446d50
push 3
call esi
mov dword [0x4d6da8], eax
pop esi
ret
mov eax, dword [0x4d6dac]
mov esi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push eax
call esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x446ec8
mov ecx, dword [0x4d6da8]
push ecx
call esi
pop esi
ret

Function at 0x4482e0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [esi + 4]
push 1
push eax
call edi
mov ecx, dword [esi + 4]
push 2
push ecx
mov dword [esi + 0x18], eax
call edi
mov edx, dword [esi + 4]
push 3
push edx
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
mov eax, dword [esi + 4]
push 4
push eax
call edi
mov ecx, dword [esi + 4]
push 5
push ecx
mov dword [esi + 0x24], eax
call edi
mov edx, dword [esi + 4]
push 6
push edx
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 4]
push 7
push eax
call edi
mov ecx, dword [esi + 4]
push 9
push ecx
mov dword [esi + 0x30], eax
call edi
mov edx, dword [esi + 4]
push 0xa
push edx
mov dword [esi + 0x34], eax
call edi
mov dword [esi + 0x38], eax
mov eax, dword [esi + 4]
push 0xb
push eax
call edi
mov ecx, dword [esi + 4]
push 0xc
push ecx
mov dword [esi + 0x3c], eax
call edi
mov edx, dword [esi + 4]
push 0xd
push edx
mov dword [esi + 0x40], eax
call edi
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
push 0xe
push eax
call edi
mov dword [esi + 0x48], eax
pop edi
pop esi
ret
Function at 0x448af0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x475f46
push eax
mov eax, 0x25cc
mov dword fs:[0], esp
call fcn.00420c90
mov eax, dword [0x4d6a78]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x25e8]
lea ecx, [esp + 0x10]
push edi
mov edi, dword [esp + 0x25f0]
push ecx
mov ecx, dword [esp + 0x25f8]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
call fcn.004377d0
xor ebx, ebx
xor eax, eax
mov dl, byte [eax + 0x4b5694]
xor dl, 0x7d
mov byte [esp + eax + 0xf08], dl
inc eax
cmp eax, 0x16d1
jb 0x448b47
lea eax, [esp + 0xf08]
mov ecx, esi
push eax
mov byte [esp + 0x25dd], bl
call fcn.0043c1b0
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
test al, al
jne 0x448b98
cmp dword [edi + 0x40], ebx
je 0x448b98
mov ecx, esi
call fcn.0043bb70
mov ecx, dword [edi + 0x40]
push eax
push ebx
push 0xc9
push ecx
call ebp
xor eax, eax
mov dl, byte [eax + 0x4b6d68]
xor dl, 0x7d
mov byte [esp + eax + 0x30], dl
inc eax
cmp eax, 0xed5
jb 0x448b9a
lea eax, [esp + 0x30]
mov ecx, esi
push eax
mov byte [esp + 0xf09], bl
call fcn.0043c1b0
and eax, 0xff
mov dword [esp + 0x20], eax
jne 0x448be6
cmp dword [edi + 0x40], ebx
je 0x448be6
mov ecx, esi
call fcn.0043bb70
mov ecx, dword [edi + 0x40]
push eax
push ebx
push 0xc9
push ecx
call ebp
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_3
push str.On_Error_Resume_Next:QMEngine.SetRunTimeParam__u:QMRoutine.SetRunTimeParam__u:On_Error_Goto_0
lea ecx, [esp + 0x28]
mov dword [esp + 0x25e8], ebx
call fcn.00430a60
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x14]
lea eax, [esp + 0x14]
push edx
push eax
lea edx, [esp + 0x18]
push ecx
push edx
mov byte [esp + 0x25f4], 1
call sub.MFC42.DLL_CString::Format_1
mov eax, dword [esp + 0x20]
add esp, 0x10
mov ecx, esi
push eax
call fcn.0043c3d0
and eax, 0xff
mov dword [esp + 0x20], eax
jne 0x448c58
cmp dword [edi + 0x40], ebx
je 0x448c58
mov ecx, esi
call fcn.0043bb70
mov ecx, dword [edi + 0x40]
push eax
push ebx
push 0xc9
push ecx
call ebp
lea ecx, [esp + 0x24]
mov byte [esp + 0x25e4], bl
call fcn.00430cc0
lea ecx, [esp + 0x10]
mov dword [esp + 0x25e4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x25dc]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x25d8
ret